topic Re: Authentication via LDAP server in General Topics

Authentication via LDAP server

TommyScott — Wed, 07 Nov 2018 16:20:23 GMT

We have a PA-3050, I have setup LDAP auth and it is working fine, however I have a question/concern. Yesterday we had a user offsite who needed VPN access, he was not in the AD group initially, so I added him to the AD group and sent him instructions on how to download the agent, when he tried to sign in, it would not allow him, ten or so mins passed and it finally authenticated him and he was able to download the agent and get on VPN.

Is there some sort of sync time I can change? My understanding is that it checks local users then passes off to the LDAP profile, so why would it take ten mins?

Re: Authentication via LDAP server

Mick_Ball — Wed, 07 Nov 2018 16:26:09 GMT

group membership is not dynamic, the palo checks ever 20 mins or so...

you can force the update of group membership with the following command...

debug user-id refresh group mapping all

or replace "all" with the group name to update just one group (CN= etc)

Re: Authentication via LDAP server

TommyScott — Wed, 07 Nov 2018 16:27:22 GMT

Is there anyway to change that? Sometimes last minute things happen and sure we can force it but ideally taking the refresh down to around 2mins or so would work way better.

Re: Authentication via LDAP server

Mick_Ball — Wed, 07 Nov 2018 16:33:03 GMT

Sure..

device\user identification\group mapping settings.

open your group mapping and modify update interval on top right hand corner...

default is actually 3600 seconds (1 hour)

not sure why i calculated that for you...

Re: Authentication via LDAP server

Mick_Ball — Wed, 07 Nov 2018 16:34:29 GMT

just bear in mind overheads,,, with some 15k userbase we probably wont be reducing it...

Re: Authentication via LDAP server

Mick_Ball — Wed, 07 Nov 2018 17:16:42 GMT

Re: Authentication via LDAP server

TommyScott — Wed, 07 Nov 2018 17:39:04 GMT

Yeah, I saw it right after I hit submit, thanks for following up.