topic Re: Can't Get AD groups to be used as user authentication in General Topics

Can't Get AD groups to be used as user authentication

mcarlton — Thu, 26 Jul 2012 16:51:06 GMT

We are running 2 2050 firewalls running 4.16 software and 2 user agents running 4.1.0-43 code. When i try to limit a policy by an AD user name it works fine. However if I want to user a AD group name it wont hit the rule if i put in the user as a group. What am i doing wrong.

MYAD\mcarlton will work for a user on a policy but

MYAD\cooladmins will not work.

What am i doing wrong?

Thanks

Mike

Re: Can't Get AD groups to be used as user authentication

u13550 — Thu, 26 Jul 2012 16:56:29 GMT

Just some ideas, as I'm currently also playing with this feature set:

have you included the ou where the groups are in into the group mappings? (Device --> User Identication" --> Group Mappings")
have you limited the LDAP Server into a Base DN where the groups are not included?

Andre

Re: Can't Get AD groups to be used as user authentication

zarina — Tue, 31 Jul 2012 00:31:44 GMT

Mike,

The issue might be with the format that ldap is pulling up the user as. The agent might be pulling up the user as xx/user1 whereas ldap might pull it up as yy/user1. Can you verify if the user is mapped the same from both the agent and ldap?

1. show user user-IDs match-user <user_name> : this is the one pulled by ldap

2. show user ip-user-mapping ip <ip_test_user> : this is per the agent

If the output of 1 and 2 are different, goto the ldap server profile settings and change the domain to the one listed in 2.

Please let me know if this was helpful.

Thanks,

Sri