topic Re: Active Directory Authentication for GlobalProtect issue in General Topics

Active Directory Authentication for GlobalProtect issue

informatiq — Wed, 14 Jun 2017 10:29:32 GMT

Hi !

Currently, I am using GlobalProtect in my network.

Also, I am configuring an Active Directory Server, and I would like to use AD users to connect to GlobalProtect (currently I'm using local users / groups in the firewall). Computers are not in the domain yet.

I have followed this tutorial : https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-Active-Directory-Server-Profile-for-Group/ta-p/58089.

When I verify connection to the LDAP server (with command: show user group name domain\usersgroup1), I've all my users.

But when I try to connect to GlobalProtect with an AD user, it's doesn't work and I have this error message in System logs: Authentification failed : Invalid username or password.

Have you got any idea to solve the problem ?

Thanks all !

This is details of my configuration :

LDAP Server Profile:

Group Mapping:

This is my Authentification profile :

And this is the GlobalProtect Authentication configuration:

Portal :

Gateway :

Re: Active Directory Authentication for GlobalProtect issue

ansharma — Wed, 14 Jun 2017 22:08:23 GMT

Very well documented post!

1) If you are entering the domain yourself, under Authentication profile->User domain, then put the user modifier as %username% only.

2) If step (1) doesn't work, then run:

> tail follow yes mp-log authd.log

and then try to authenticate. Copy and paste those logs here.

Good Luck!

Re: Active Directory Authentication for GlobalProtect issue

acc6d0b3610eec313831f7900fdbd235 — Wed, 14 Jun 2017 22:52:27 GMT

Hi @informatiq

In the Group Mapping --> Domain Setting --> User Domain, include only your NetBios name or leave it blank, for instance: in your example it is domain.ad, so leave it as domain

In the Authentication Profile User Domain field, either remove it completely or also include only your NetBios.

Both actions should resolve this issue for you.

I hope this helps.

Willian

Re: Active Directory Authentication for GlobalProtect issue

MohamedSharief — Thu, 15 Jun 2017 06:48:26 GMT

Use Authentication Sequence profile instead of separate local and LDAP logins, and remove the user domain from the group mapping & auth profile.

Regards,

Sharief