topic Re: Invalid Role - RADIUS in General Topics

Invalid Role - RADIUS

SDorsey — Thu, 27 Aug 2015 19:00:20 GMT

Greetings!

Am troubleshooting PA authentication using RADIUS. The user is part of the appropriate AD group for the RADIUS configuration and the PA and RADIUS server are both setup for RADIUS auth.

On the PA side, added an administrator and set their auth profile as the radius profile. When the user tries to login, the PA log shows:

User 'userX' authentication. From: IP

then another message

Authorization failed for user Userx via Web from IP : Invalid role

Re: Invalid Role - RADIUS

OtakarKlier — Thu, 27 Aug 2015 19:17:14 GMT

While I cannot remember the exact error we were seeing, however our usernames had a special character in the begining and the PAN did not like that at all.

Not sure if that is the case here.

Re: Invalid Role - RADIUS

Lucky — Thu, 27 Aug 2015 21:02:27 GMT

Hello,

when you added that new admin, can you check if you selected his/hers role as "dynamic" or "role based"? Could it be that you are missing role setup? Change that to dynamic just for test?

Regards

Luciano

Re: Invalid Role - RADIUS

SDorsey — Thu, 27 Aug 2015 21:15:26 GMT

Thank you for your reply. It's set to Dynamic - Superuser.

Re: Invalid Role - RADIUS

Lucky — Thu, 27 Aug 2015 21:18:07 GMT

OK, next, did you check the box on your RADIUS profile "Administrator use only" (just underneath the profile name itself)?

Re: Invalid Role - RADIUS

Lucky — Thu, 27 Aug 2015 21:20:02 GMT

and if you did, did you also try to uncheck it 😄

Re: Invalid Role - RADIUS

Lucky — Thu, 27 Aug 2015 21:55:16 GMT

Hi,

few more things that could be useful in troubleshooting:

less mp-log authd.log

tail follow yes mp-log authd.log

and if needed, big hammer:

last, but not the least, a few articles...

troubleshooting radius

https://live.paloaltonetworks.com/t5/Articles/Troubleshooting-RADIUS-Authentication/ta-p/59200

identify secret key mismatch for radius

https://live.paloaltonetworks.com/t5/Articles/How-to-Identify-Secret-Key-Mismatch-Between-Palo-Alto-Networks/ta-p/54612

Admin roles (in panorama but you can correlate):

https://live.paloaltonetworks.com/t5/Articles/Separate-Panorama-Admins-Access-Domains-using-RADIUS/ta-p/54432

Regards

Luciano

Re: Invalid Role - RADIUS

CharlesAntonyAlfred — Mon, 20 Mar 2023 15:02:09 GMT

I am facing the exact same issue. Did you happen to resolve this? If so, could you please let me know the fix.

Re: Invalid Role - RADIUS

Schneur_Feldman — Fri, 14 Jul 2023 19:57:51 GMT

Same issue as well