topic Re: User to group maping for xml-api user who provided no domain string in General Topics

User to group maping for xml-api user who provided no domain string

TomaszLubas — Wed, 06 Jul 2016 11:40:15 GMT

Hello,

i need to map user to ldap group. For desktops there is no problem, mappings goes well. But if some user connects via smartphone and didn't provide DOMAIN\ then problem occur. Is there any way to achieve this goal ?

Typing DOMAIN\ on mobile keyboard is difficoult.

Users are authenticated through 802.1x on extrenal NAC and user-id is passed via XML-API

best regards,

Tomek

Re: User to group maping for xml-api user who provided no domain string

reaper — Wed, 06 Jul 2016 12:22:49 GMT

Did you make sure to add the domain name to the user domain attribute in the LDAPprofile/GroupMappingProfile

Re: User to group maping for xml-api user who provided no domain string

TomaszLubas — Wed, 06 Jul 2016 13:09:26 GMT

Hello,

as far as i know this setting is to replace LDAP response. If client log to the network with username only [john.smith instead of DOMAIN\john.smith] then palo alto cannot compare it to LDAP response domain\username. Doesn't metter if i compare it to oryginal ldap response or replaced domain prefix ldap response it still doesn't solve problem.

Re: User to group maping for xml-api user who provided no domain string

Retired Member — Fri, 09 Dec 2016 09:21:44 GMT

I see two options:

a) add domain to user name when sending entry via API,

b) gather User-ID through Syslog Sender, you can define the Default Domain Name of those mappings.

It will be possible if there is only one domain for users.

Hope it helps 🙂