topic Re: GP portal error in General Topics

GP portal error

Mohammed_Yasin — Tue, 08 Jun 2021 09:04:30 GMT

Restriction of the users on the GP portal page.

We selected a particular group in the allowed list, but authentication was failing unless we select all.

Re: GP portal error

Mick_Ball — Tue, 08 Jun 2021 15:35:59 GMT

from cli... type

show user group list

then type

show user group name "name of the group required"

check that the users are all in the group as expected and also check the domain\username is the same domain as auth profile user domain setting.

try that for starters...

Re: GP portal error

aleksandar.astardzhiev — Tue, 08 Jun 2021 17:21:13 GMT

Hi @Mohammed_Yasin ,

Almost every time I have seen this behaviour it is caused by differences how the group mapping is reporting the users and how the authentication profile is logging the username - mainly in the domain.

If your authentication profile is accepting only username (without domain) as user input, while the group mapping is returning domain/username.

@Mick_Ball already give you steps how to check what format are you receiving from group mapping.

Re: GP portal error

Remo — Tue, 08 Jun 2021 17:33:28 GMT

Do you restrict the users directly in the portal configuration or in the authentication profile?

If you use the portal configuration, were you able to choose the group from the dropdown? If not, did you also try to enter the DN of the group (all lowercase)?

Re: GP portal error

Mohammed_Yasin — Wed, 09 Jun 2021 12:04:07 GMT

My Actual Issue,

GlobalProtect Portal or Agent users fail authentication

My Authentication Profile has specific filtered groups. The users appear to be in the group that makes up the allow list. However, the message "user not in allow list" still appears. If the allow list is changed to have "all" rather than specific groups, the user authenticates fine.

And I followed this link https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClizCAC