topic User-ID and child domain Global Catalog server in General Topics

User-ID and child domain Global Catalog server

Davyboy — Wed, 03 May 2017 13:22:23 GMT

Hi,

I have a deployment question in regard to User-ID and multi domain.

If we are trying to pull group mappings and have user ID setup only on a child domain server through GC LDAP, the user credentials used to login and thus pick up with the userid is in the format below.
- child.domain.com\user
- domain\user

I don't think it's possible to have two domain mapping for the same domain, this being as fqdn-domain-name/username (child.domain.com\user) and netbios/domain-name (domain\user)

But the end goal is to have both users mapped depending on how the user logs in.

Is this even possible? Internal discussions seem to agree that it is not possible.

If anyone has any input or what they could suggest as a better way, or if it can work like and how we do it? I would be greatful.

Currently running panos 7.1.6.

Regards,

Davyboy.

Re: User-ID and child domain Global Catalog server

jdelio — Wed, 03 May 2017 14:52:18 GMT

FYI, this topic was moved from Community Feedback to the General Topics area, as discussions about Palo Alto Networks products should not be in the Community Feedback area.

Re: User-ID and child domain Global Catalog server

Davyboy — Fri, 16 Jun 2017 12:49:27 GMT

With help from a colleague we resolved this issue. It actually can be done with a single LDAP profile using port 3268 for the GC server connection.

If you bind to port 389, even if you bind to a Global Catalog server, your search includes a single domain directory partition. If you bind to port 3268, your search includes all directory partitions in the forest. If the server you attempt to bind to over port 3268 is not a Global Catalog server, the server refuses the bind.

Davyboy.

Re: User-ID and child domain Global Catalog server

MyDang — Tue, 18 Jul 2017 20:57:08 GMT

Thanks. Limitation resolved after changing to port 3268