topic Re: Global Protect User Groups in General Topics

Global Protect User Groups

BatD — Fri, 08 Nov 2019 11:55:11 GMT

I want to user map configuration to AD user group for Global Protect clientless VPN. This works quite will if authentication is LDAP.
Have you any idea how can I get it to work with Radius authentication? Presuming that the user has the same name as the LDAP user, would they be matched to the relevant AD group?

Re: Global Protect User Groups

S.Cantwell — Fri, 08 Nov 2019 14:31:09 GMT

I would believe so.

I am of the opinion that you are confusing (respectfully) WHAT group a user is a member of vs HOW the user Authenticates.

If the Radius server says the person is authenticated... then he is authenticated... it is the LDAP Grouping that determines what configuration the user will be mapped to.

Excellent question.

What other questions do you have?

Thanks.

Re: Global Protect User Groups

Mick_Ball — Fri, 08 Nov 2019 15:29:54 GMT

By default... no.

the user fred smiff will not be the same as group member domain\fred smiff.

for this to work you need to add the domain name into the authentication profile.

Re: Global Protect User Groups

S.Cantwell — Fri, 08 Nov 2019 17:42:09 GMT

@Mick_Ball Agreed.

I am making presumption that access to the clientless VPN is based on AD groups, and Auth Profile should already have the correct domain listed.

Thanks for confirming!

steve