User/Group mapping OpenLDAP

jmrodriguez — Wed, 29 Aug 2012 12:04:24 GMT

Hello.

My situation is:

- GlobalProtect VPN configurated -> user identification via GP then.

- LDAP profile configurated -> authentication works well

- Authentication profile configurated.

- User Identification, Group Mapping configuration:

- Group Objects:

- Object Class: posixGroup

- Group Name: cn

- Group Member: memberUid

- User Objects:

- Object Class: inetOrgPerson

- User Name: uid

Extract with slapcat:

----------------------

dn: cn=Administradores,ou=Grupos,dc=example,dc=com

cn: Administradores

gidNumber: 1

structuralObjectClass: posixGroup

entryUUID: 1dacb5d4-85f9-1031-95fb-b388bfd09fc7

creatorsName: cn=admin,dc=example,dc=com

createTimestamp: 20120829074432Z

objectClass: posixGroup

memberUid: prueba

entryCSN: 20120829112946.273933Z#000000#000#000000

modifiersName: cn=admin,dc=example,dc=com

modifyTimestamp: 20120829112946Z

dn: cn=prueba,ou=Usuarios,dc=example,dc=com

sn: prueba

cn: prueba

uid: prueba

userPassword:: e01ENX1iKzBKTmZNdFFFSnh1cVN5a3FPNWJBPT0=

uidNumber: 5

gidNumber: 1

homeDirectory: /home/users/satec1

objectClass: inetOrgPerson

objectClass: posixAccount

objectClass: top

structuralObjectClass: inetOrgPerson

entryUUID: a6c2f1f4-860c-1031-989f-db7857189845

creatorsName: cn=admin,dc=example,dc=com

createTimestamp: 20120829100422Z

entryCSN: 20120829100422.934537Z#000000#000#000000

modifiersName: cn=admin,dc=example,dc=com

modifyTimestamp: 20120829100422Z

-----------------------------

I can use the created groups on OpenLDAP correctly, in firewall rules:

admin@PA-2050> show user group-mapping state all

Group Mapping(vsys1, type: other): Mapeo_Grupos_LDAP

Bind DN : cn=admin,dc=example,dc=com

Base : dc=example,dc=com

Group Filter: (None)

User Filter: (None)

Servers : configured 1 servers

X.Y.Z.8(389)

Last Action Time: 1489 secs ago(took 1 secs)

Next Action Time: In 2111 secs

Number of Groups: 3

cn=vpn,dc=example,dc=com

cn=usuarios,ou=grupos,dc=example,dc=com

cn=administradores,ou=grupos,dc=example,dc=com

admin@PA-2050>

And I can connect to VPN and the user is identified:

admin@PA-2050> show user ip-user-mapping all

IP Ident. By User Idle Timeout (s) Max. Timeout (s)

--------------- --------- -------------------------------- ---------------- ----------------

192.168.46.3 GP prueba 3651 3651

Total: 1 users

admin@PA-2050>

But the problem is that user is not "mapped" in its group, Administradores:

admin@PA-2050> show user ip-user-mapping detail yes

IP address: 192.168.46.3

User: prueba

Ident. By: GP

Idle Timeout: 3529s

Max. TTL: 3529s

Groups that the user belongs to (used in policy)

admin@PA-2050>

So when I create a firewall rule as origin user the group Administradores, the traffic generated by the user "prueba" doesn't match with that rule.

I think it must be a problem with "User Object" configuration but I can't find doc about that, an example like AD in the document: http://live.paloaltonetworks.com/docs/DOC-3221.

Anybody with a similar configuration could help me?

Thank you very much.

To be sure, I created on my OpenLDAP server a user account that has the same name in cn, sn, and uid: test.

Re: User/Group mapping OpenLDAP

jmrodriguez — Thu, 30 Aug 2012 12:01:36 GMT

Hi everybody.

For your information, the configuration above is correct. The problem is that it's necessary to specify a domain in LDAP server configuration. After that, the scenario works well. I can selected users and groups on security rules... Great!!!.

Thank you.

Re: User/Group mapping OpenLDAP

mindterra — Sat, 01 Sep 2012 07:39:24 GMT

Hi, I also found the problem that a user in a group can't hit a rule that set the user group.

the configuration is below, could you please help me identify what wrong with this configuration ?

=== LDAP Server ===

Domain : palo-lab

Type : other

Base : dc=palo-lab,dc=com

Bind DN : cn=ldapadm,dc=palo-lab,dc=com

=== Group Mapping ===

Group objects

- Search Filter :

- Object Class : posixGroup

- Group Name : internet

- Group Member : memberUid

User Objects

- Search Filter :

- Object Class : posixAccount

- User Name : uid

Re: User/Group mapping OpenLDAP

jmrodriguez — Tue, 04 Sep 2012 06:36:39 GMT

Hello mindterra.

In group name I've specified "cn", no "internet". One important thing is that "memberUid" in Group object must match with "uid" in user object.

That is, check strings that appear in memberuid field in group objects; it must be the login name of the users, more than the complete name (jdoe vs John Doe)

Bye bye.

Re: User/Group mapping OpenLDAP

jerick — Fri, 01 Mar 2013 06:58:12 GMT

Hello Jm,

Can I ask, What is the OS your OpenLDAP is installed?.

I have also a problem in configuring the OpenLDAP(which is installed in Linux CentOS) on PA2020.

Re: User/Group mapping OpenLDAP

Netsul — Mon, 19 May 2014 14:12:52 GMT

I'm having the same problem as was solved

topic Re: User/Group mapping OpenLDAP in General Topics

User/Group mapping OpenLDAP

Re: User/Group mapping OpenLDAP

Re: User/Group mapping OpenLDAP

Re: User/Group mapping OpenLDAP

Re: User/Group mapping OpenLDAP

Re: User/Group mapping OpenLDAP