topic Re: 8.1.0 Upgrade issue: Group names in allow-list of an LDAP authentication profile no longer work in General Topics

8.1.0 Upgrade issue: Group names in allow-list of an LDAP authentication profile no longer work

bspilde — Wed, 07 Mar 2018 23:22:33 GMT

Group “Allow lists” no longer worked for LDAP authentications. We could no longer connect to GlobalProtect until set it to All or specified each LDAP user account.

We had to forcefully clear the ID Manager database

debug user-id reset user-id-manager type user-group

Re: 8.1.0 Upgrade issue: Group names in allow-list of an LDAP authentication profile no longer work

BPry — Thu, 08 Mar 2018 02:19:54 GMT

@bspilde,

I don't believe that this is actually a reported issue as of yet; at least not that I saw with a quick look through the release notes. Out of curiosity did you actually report this to TAC, and did reseting the ID Manager database actually resolve the issue and allow you to utilize the allow lists?

Re: 8.1.0 Upgrade issue: Group names in allow-list of an LDAP authentication profile no longer work

bspilde — Thu, 08 Mar 2018 15:43:45 GMT

Yes this resolution was via TAC and all is well now after resetting the database.

Re: 8.1.0 Upgrade issue: Group names in allow-list of an LDAP authentication profile no longer work

bspilde — Thu, 08 Mar 2018 15:48:20 GMT

Also, this may not be specific to an 8.1.0 upgrade, that's just the event that caused me to experience it.

The other thing with the upgrade is it can clear out the %USERINPUT% and set it to "None" on the Auth Profile's UserName Modifier.

Re: 8.1.0 Upgrade issue: Group names in allow-list of an LDAP authentication profile no longer work

NeilR — Fri, 19 Apr 2019 19:02:28 GMT

I had the same issue after upgrade to 8.1. As I had not seen this article I have not yet tried clearing the groupID db.

I decided to downgrade instead to further research. I found that even with a pre upgrade backup that was used during the downgrade, the issue persists.

I discovered that deleteing the auth profile and then re-syncing from the untocuhed HA partner returned it to expected function.