How to Configure LDAP Settings and Group Mapping for Apple Open Directory

Overview

This document describes how to configure the LDAP settings and Group Mapping for Apple Open Directory on a Palo Alto Networks device.

Steps

To connect to the Apple Open Directory:

1. Navigate to Device > Server Profiles > LDAP
2. Click 'Add' to bring up a new LDAP Server Profile dialog
3. Select 'other' for Type
4. For Bind DN, the default Apple Open Directory admin is uid=diradmin. The following image shows an example of a configured LDAP Server Profile for Apple Open Directory:
   

To configure Group Mapping:

1. Go to Device > User Identification > Group Mapping Settings
2. Click 'Add' to bring up a new Group Mapping dialog
3. Select the configured Open Directory profile for Server Profile
4. In the Group Objects section, enter 'apple-group' for the Object Class and 'memberUid' for the Group Member
5. In the User Objects section, enter 'apple-user' for the Object Class and 'uid' for the User Name

owner: mbutt