topic Authentication via LDAP server not sending complete DN name in General Topics

Authentication via LDAP server not sending complete DN name

Venkatesan_radhakrishnan — Thu, 27 Sep 2018 06:17:01 GMT

Hi Team,

I have configured LDAP server profile and confirmed the condition of reading group via Group mapping it works.

When I try to test the LDAP username through authentication profile it succeed upto LDAP authentication but after it is sending DN name only with domain name and my user get failed to authenticate.

What else I need to check.

test authentication authentication-profile LDAP user name remesk[K[K[K[K[K[Kremeshk [K[A[Kadmin-remeshk@TH-FW-PA3060> test authentication authentication-profile LDAP user name remeshk password
Enter password :
[?1h=[40;1H[K
Target vsys is not specified, user "remeshk" is assumed to be configured with a shared auth profile.

Do allow list check before sending out authentication request...
name "trojanholding.ae\remeshk" is in group "all"

Authentication to LDAP server at 10.3.4.10 for user "remeshk"
Egress: 172.25.25.4
Type of authentication: plaintext
Starting LDAP connection...
Succeeded to create a session with LDAP server
DN sent to LDAP server: DC=trojanholding,DC=ae
Authentication failed against LDAP server at 10.3.4.10:389 for user "remeshk"

Authentication to LDAP server at 10.3.4.11 for user "remeshk"
Egress: 172.25.25.4
Type of authentication: plaintext
Starting LDAP connection...
Succeeded to create a session with LDAP server
DN sent to LDAP server: DC=trojanholding,DC=ae
Authentication failed against LDAP server at 10.3.4.11:389 for user "remeshk"

Authentication failed for user "remeshk"

Re: Authentication via LDAP server not sending complete DN name

Mick_Ball — Thu, 27 Sep 2018 12:19:34 GMT

when you test LDAP via the test command it does not use all configured parts of the authentication profile. it does not use any domain modifier that you have set.

Re: Authentication via LDAP server not sending complete DN name

Venkatesan_radhakrishnan — Thu, 27 Sep 2018 12:21:54 GMT

No it is not like that way, Here I found actually the username is missing the root structure of the domain in AD.

Re: Authentication via LDAP server not sending complete DN name

Mick_Ball — Thu, 27 Sep 2018 12:25:24 GMT

sorry i am confused, can you show me a test that does work...

Re: Authentication via LDAP server not sending complete DN name

Venkatesan_radhakrishnan — Thu, 27 Sep 2018 12:28:01 GMT

admin@PA-VM> test authentication authentication-profile Auth-GP username venkatesan password
Enter password :

Target vsys is not specified, user "venkatesan" is assumed to be configured with a shared auth profile.

Do allow list check before sending out authentication request...
name "venkatesan" is in group "all"

Authentication to LDAP server at 172.16.3.142 for user "venkatesan"
Egress: 192.168.30.1
Type of authentication: plaintext
Starting LDAP connection...
Succeeded to create a session with LDAP server
DN sent to LDAP server: CN=venkatesan r.,CN=Users,DC=abdalla,DC=local
User expires in days: never

Authentication succeeded for user "venkatesan"

Re: Authentication via LDAP server not sending complete DN name

Mick_Ball — Thu, 27 Sep 2018 12:38:46 GMT

ok so now show test that doesn't work.

Re: Authentication via LDAP server not sending complete DN name

Venkatesan_radhakrishnan — Thu, 27 Sep 2018 12:40:04 GMT

it works