topic Re: GlobalProtect LDAP Authentication Fails in General Topics

GlobalProtect LDAP Authentication Fails

welly_59 — Mon, 02 Jul 2018 15:35:20 GMT

I have succesfully set up local login for GP but struggling to set up LDAP authentication. The CLI test says that its succesfull, but it fails whne using GP

Any tips please?

Re: GlobalProtect LDAP Authentication Fails

welly_59 — Mon, 02 Jul 2018 15:46:50 GMT

my specific error now is:

GlobalProtect gateway client configuration failed. User name: MY.NAME Client OS version: Microsoft Windows 10 Enterprise , 64-bit, error: Matching client config not found.

Also this is not letting me change to local login, the GP client locks down to using my domain username

Re: GlobalProtect LDAP Authentication Fails

welly_59 — Mon, 02 Jul 2018 16:03:10 GMT

New Error:

You are not authorised to connect to globalprotect portal

Re: GlobalProtect LDAP Authentication Fails

BPry — Mon, 02 Jul 2018 16:58:14 GMT

@welly_59,

Doesn't really seem like it's failing at LDAP auth, sounds like you haven't configured a client config in the gateway configuration (or it isn't configured properly). Might want to verify that you have properly setup the client configuration and then verify that the 'Client Authentication' settings that you've configured on the Gateway are setup properly.

Re: GlobalProtect LDAP Authentication Fails

Mick_Ball — Mon, 02 Jul 2018 18:12:47 GMT

Is your GP portal config restricted to certain users.... perhaps a group... if so... try changing to “all”.

Re: GlobalProtect LDAP Authentication Fails

welly_59 — Mon, 02 Jul 2018 18:55:36 GMT

It is set to certain groups. I can log into the web portal with ldap credentials no problem but I then get the error that there is no matching client config.

I’ll tale some screenshots tomorrow of my config if you guys will be good enough to assist

Re: GlobalProtect LDAP Authentication Fails

welly_59 — Mon, 02 Jul 2018 20:39:34 GMT

Could someone please take a look at my comfigs and see where I am going wrong? Local authenticated users work fine but I get a variety of errors when I authenticate with LDAP, ranging from no client config available to not authorized to access portal depending on what I change in these settings

Re: GlobalProtect LDAP Authentication Fails

Mick_Ball — Tue, 03 Jul 2018 07:47:00 GMT

firstly, do you have the same group settings in portal agent, i can only see gateway agent?

so....

from cli.

show user group list

this should display all relative groups and hopefully you will see the one thats blanked out in you agent config.

then...

show user group name "<the relevant group from above>"

this will list all known members of that group. If you check on the gui monitor/system you can see the user authenticating, make sure that user can be seen in the group within cli.

Re: GlobalProtect LDAP Authentication Fails

welly_59 — Tue, 03 Jul 2018 18:00:25 GMT

Got to the bottom of it......

I had not added allowed groups in the group mapping section.

Re: GlobalProtect LDAP Authentication Fails

Mick_Ball — Wed, 04 Jul 2018 12:13:28 GMT

Nice one Mr Welly...