topic Re: Client Authentication Sequence only works for 1st item in the list in General Topics

Client Authentication Sequence only works for 1st item in the list

rhap4boy — Tue, 09 Apr 2019 05:23:07 GMT

I configured Client Authentication Sequence for both GlobalProtect Portal and Gateway for both LDAP and local database. For some reason, only the first item in the list works. It does not seem to try the rest of the sequences in the list. If LDAP is first in the list, then LDAP authentication works but not Local database. If Local databse is first in the list, then local database authentication works but not LDAP authentication. What could be causing this? This is 9.0 version.

Re: Client Authentication Sequence only works for 1st item in the list

Mick_Ball — Tue, 09 Apr 2019 06:04:22 GMT

Auth sequence is simply a list of possible auth services. It will run down the list until one is accepted.

it is not designed for MFA.

you could look into Globalprotect MFA, there are plenty of links available, i use cert and Ldap.

you could just have local for portal and ldap for gateway.

although this could be less secure if portal is down and client uses cached gateway address.

Re: Client Authentication Sequence only works for 1st item in the list

LCMember2099 — Tue, 09 Apr 2019 14:57:15 GMT

Not trying to do multiple factor authentication. I simply want to two different methods of login in. Use either local database or LDAP. It suppose to take the login name and password and try each of the method in sequence until one login right?

Re: Client Authentication Sequence only works for 1st item in the list

Mick_Ball — Tue, 09 Apr 2019 17:43:46 GMT

Yes that is what should happen, sorry for the confusion, i thought you were trying to use 2 logins...

Does it say in monitor/system that it failed on just the first, i can try this on my test boxes tomorrow

Re: Client Authentication Sequence only works for 1st item in the list

Mick_Ball — Thu, 11 Apr 2019 08:26:17 GMT

i have ldap server 1, ldap server 2 and local database in my sequence.

i can login with either my local account or my ldap account so not sure whats going wrong for you.

i did confirm the sequence was working with monitor/packet capture to see a request going to all servers.