About User-ID configurate

[young19918]

Hello,

My User-ID agent was successfully linked to PA and I also saw Source User in the log.

I then configured the LDAP and group mapping and applied its source user to the new policy and wanted to verify that it worked.

I found that the PAs were all using the old policy (LAN_to_WAN) and it seemed that the PAs were not catching the source users to use new policy (Test_User)...

Any help is appreciate.

[TomYoung]

Hi @young19918 ,

When a user does not match a group, it is almost always is because the username format does not match.

1. Show the username format in the IP-mappings with the CLI "show user ip-user-mapping all" command.
2. Show the username format in the group mappings with the CLI "show user group list" and "show user group name <group>" commands.  Use quotes if your group name has spaces.
3. Verify that the format is the same for the user in both outputs.

If the domain does not match or is missing, you can manually configure the User Domain (Domain Override) for the user-IP mappings in the authentication profile or for the user-group mappings under the Server Profile tab.

If the username format is different (e.g., domain\user = sAMAccountName vs. user@domain = userPrincipalName) you can modify the Primary Username under the User and Group Attributes tab in the Group Mapping settings.  Or, you can change the Username Modifier in the authentication profile.

Thanks,

Tom