topic Re: Pulling in users directly from ADDS? in General Topics

Pulling in users directly from ADDS?

cra1901 — Thu, 05 Aug 2021 10:36:17 GMT

I have a requirement to pull in our users from Azure AD (or AADDS depending on the solution) into Prisma Cloud in order to create policy rules based on the source user/group but I'm unsure as to which method I would need to set this up? (Device\LDAP, Panorama\LDAP or Cloud Identity Engine - perhaps there's more than one way?!)

We do not have a Windows domain and therefore have no on-prem DC to connect to. Has anyone else got this set up that could point me in the right direction?

TIA

Re: Pulling in users directly from ADDS?

NikolayDimitrov — Thu, 05 Aug 2021 10:51:37 GMT

There is a guide for this:

https://www.paloaltonetworks.com/resources/guides/prisma-access-for-users-deployment-guide

I think also SAML is a nice option where the Prisma Access will be SP and Azure AD will be the IdP.

https://www.consigas.com/best-practice/remote-access-authentication/

Re: Pulling in users directly from ADDS?

cra1901 — Thu, 05 Aug 2021 11:15:55 GMT

Thank you for your help

Re: Pulling in users directly from ADDS?

NikolayDimitrov — Thu, 05 Aug 2021 11:26:57 GMT

This is not for Azure AD but it shows how to extract the SAML atributes for user and group membership:

https://saml-doc.okta.com/SAML_Docs/How-to-Configure-SAML-2.0-for-Palo-Alto-Networks-GlobalProtect.html

Re: Pulling in users directly from ADDS?

cra1901 — Thu, 05 Aug 2021 14:46:32 GMT

Hi Nikolay - just to clarify, I'd like to import Azure AD groups into Palo Alto so that I can create rules based on them. E.g. create a policy rule that allows the Marketing dept to connect to an external application. Do the instuctions you have given me go through the steps to enable this?

Thanks.

Re: Pulling in users directly from ADDS?

NikolayDimitrov — Thu, 05 Aug 2021 16:48:18 GMT

From the Palo Alto side of things yes but you still need to configure the correct attributes for user/group on the Azure AD (Azure AD should have good guides how it can be used as SAML IdP). After the SAML has imported the users and groups in the Palo Alto/Prisma Access look at :

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClXWCA0

User redistribution inside prisma access should happen automatically but if you also have on premise devices look at:

https://docs.paloaltonetworks.com/prisma/prisma-access/prisma-access-panorama-admin/configure-user-based-policies-with-prisma-access/redistribute-userid-information-for-users-and-networks

Re: Pulling in users directly from ADDS?

cra1901 — Thu, 05 Aug 2021 16:58:46 GMT

Thanks again for your help!