topic Re: LDAP Authentication Profile missing when trying to add administrator user in General Topics

LDAP Authentication Profile missing when trying to add administrator user

jakeevans — Tue, 12 Dec 2017 17:26:09 GMT

I have created an authentication profile utilizing a connection to the LDAP servers. When I try to add an Administrator I am unable to select this authentication profile from the drop down menu. All that is available is "none."

I think that my server and authentication profiles are set up correctly as I am able to test the authentication profile using the commend line as follows:

admin@ddc-rt-fw-vpn-q08-2 vsys1> test authentication authentication-profile Auth-LDAP username u0852540 password
Enter password :

Target vsys: vsys1

Do allow list check before sending out authentication request...
name "ad\u0852540" is in group "all"

Authentication to LDAP server at X.X.X.X for user "u0852540"
Egress: X.X.X.X
Type of authentication: GSSAPI
Starting LDAPS connection...
Succeeded to create a session with LDAP server
DN sent to LDAP server: CN=u0852540,OU=People,DC=ad,DC=XXX,DC=edu
User expires in days: never

Authentication succeeded for user "u0852540"

Any thoughts or suggestions would be greatly appreciated.

Thanks!!

Re: LDAP Authentication Profile missing when trying to add administrator user

reaper — Wed, 13 Dec 2017 12:12:32 GMT

I think you created the authentication profile in vsys1

administrators are system level, so they can only use authentication profiles that are 'shared'

Re: LDAP Authentication Profile missing when trying to add administrator user

jakeevans — Wed, 13 Dec 2017 14:46:13 GMT

Excellent advice! Problem solved!

For the record, I had to recreate my server profile in "shared" and then create a new authentication profile in "shared" as well. Once that was done I was able to create administrators using the "shared profile" and they were able to successfully log in.

Thanks so much for your help!