Expedition Articles
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Featured Article
Expedition offers local user authentication and external user authentication via LDAP and Radius servers.   In this example, we will illustrate how to configure external authentication via a Windows Active Directory server.     Settings in LDAP Server We have created a server under the domain sctc.domain.local, defined a group called "developers" and added a user "didac gil" with logon name "didacgil9".   In the figure, we can notice that users authenticate with the suffix "@sctc.domain.local". We will have to take account of this value for providing the correct settings in Expedition to complete the user authentication.   View of Active Directors Users and Computers, highlighting @sctc.domain.local in a user account.   Defining LDAP Server in Expedition In Expedition, we will first define the LDAP authentication server. Only Superusers have rights for server registration or modification. We have two different approaches for user authentication.   Approach 1. User needs to enter full logon name Define a server providing the desired server's name, the server's address and port, server type (Windows or Linux), Search DN parameters and SSL and/or TLS usage.   In our case, we our server responds at sctc.domain.local port:389 and we have named LDAP_approach1. The users that will use this server for authentication belong to the developers group, therefore we have provided the following Search DN: "CN=developers,DC=sctc,DC=domain,DC=local". Contact your Active Directory administrator to verify your correct Search DN parameters.     View of Approach 1 to Add New LDAP Server using the address sctc.domain.local.   After saving, we will test the server settings clicking on the diagnostics icon. We will be required to enter an existing user's credentials.    View of LDAP Test Connection   A feedback will be provided with the results of the connection.   Through this approach, users will have to provide their full account name for authentication. In our case, didacgil9@sctc.domain.local will be the user name account required to have a valid authentication.     Approach 2. Server specifies the user suffix In this case, we will facilitate the user's logon, providing the suffix already in the server settings. This way, a user will only have to write their account name "didacgil9". View of Approach 2 to Add New LDAP Server using the address sctc.domain.local.   Notice that using this approach, all users must share the same suffix in order to be able to validate their credentials.
View full article
  • 54 Posts
  • 267 Subscriptions
Customer Advisories

Your security posture is important to us. If you’re a Palo Alto Networks customer, be sure to login to see the latest critical announcements and updates in our Customer Advisories area.

Learn how to subscribe to and receive email notifications here.

Listen to PANCast

PANCast is a Palo Alto Networks podcast that provides actionable insights to customers, helping you maximize your investment while improving your cybersecurity posture.

Top Contributors
Top Liked Authors