topic Re: LDAP auth for the WEB UI access clarification in General Topics

LDAP auth for the WEB UI access clarification

myky — Tue, 13 Aug 2019 19:22:05 GMT

Hi All,

Why do we need step 3 mentioned in the KB below for the WB UI authentication with LDAP?:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGuCAK

Why do we need to create a local user? Won't Palo be an LDAP proxy (grabbing username/password and verifying it against LDAP server database)?

Re: LDAP auth for the WEB UI access clarification

Mark_Brook — Tue, 13 Aug 2019 19:25:38 GMT

Palo Alto uses a more secure mentality for the Admin users on the firewalls. Calling out the users specificly is a lot more secure they refrenceing an AD group. Anyone with the right AD privlages could modify the AD group and give themselves superuser access to the firewalls.

Re: LDAP auth for the WEB UI access clarification

myky — Tue, 13 Aug 2019 19:37:55 GMT

@Mark_Brook thanks, it makes sense. So what is PA actually verifying, just AD membership group and not username/password?

Re: LDAP auth for the WEB UI access clarification

Mark_Brook — Tue, 13 Aug 2019 19:37:40 GMT

Its verifying Username(both places), Password, and if you configured a group in your Ldap profile it will do that as well.

Re: LDAP auth for the WEB UI access clarification

myky — Tue, 13 Aug 2019 19:41:09 GMT

Cool, so the local user is another (additional) check as you mentioned earlier. Thanks.

Re: LDAP auth for the WEB UI access clarification

BrandonWright — Wed, 14 Aug 2019 13:54:40 GMT

Palo Alto only has this requirment for LDAP Authentication only when managing the device. You can use a RADIUS server with RADIUS authentication profile to allow management by AD group, and that works fine, so if you have Microsoft IAS, or other RADIUS server, that will work for allowing a group to authenticate to the firewall and/or panorama.

Re: LDAP auth for the WEB UI access clarification

myky — Wed, 14 Aug 2019 13:59:16 GMT

@BrandonWright this now clear as day (but not a typical day in UK 🙂

Re: LDAP auth for the WEB UI access clarification

AustinClark — Thu, 24 Apr 2025 19:33:38 GMT

Do you have a reference for this. Why would palo do this only for LDAP? Extremely annoying moving from tacacs to ldap.

Re: LDAP auth for the WEB UI access clarification

santonic — Thu, 08 May 2025 12:48:46 GMT

Because LDAP server doesn't send back admin role so you can't do authorization with LDAP server.