8.1.0 Upgrade issue: Group names in allow-list of an LDAP authentication profile no longer work

Reply
L4 Transporter

8.1.0 Upgrade issue: Group names in allow-list of an LDAP authentication profile no longer work

Group “Allow lists” no longer worked for LDAP authentications. We could no longer connect to GlobalProtect until set it to All or specified each LDAP user account.

 

We had to forcefully clear the ID Manager database

 

              debug user-id reset user-id-manager type user-group

L7 Applicator

Re: 8.1.0 Upgrade issue: Group names in allow-list of an LDAP authentication profile no longer work

@bspilde,

I don't believe that this is actually a reported issue as of yet; at least not that I saw with a quick look through the release notes. Out of curiosity did you actually report this to TAC, and did reseting the ID Manager database actually resolve the issue and allow you to utilize the allow lists? 

L4 Transporter

Re: 8.1.0 Upgrade issue: Group names in allow-list of an LDAP authentication profile no longer work

Yes this resolution was via TAC and all is well now after resetting the database.

L4 Transporter

Re: 8.1.0 Upgrade issue: Group names in allow-list of an LDAP authentication profile no longer work

Also, this may not be specific to an 8.1.0 upgrade, that's just the event that caused me to experience it.

 

The other thing with the upgrade is it can clear out the %USERINPUT% and set it to "None" on the Auth Profile's UserName Modifier.

 

L1 Bithead

Re: 8.1.0 Upgrade issue: Group names in allow-list of an LDAP authentication profile no longer work

I had the same issue after upgrade to 8.1. As I had not seen this article I have not yet tried clearing the groupID db.

 

I decided to downgrade instead to further research. I  found that even with a pre upgrade backup that was used during the downgrade, the issue persists.

 

I discovered that deleteing the auth profile and then re-syncing from the untocuhed HA partner returned it to expected function.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!