Active Directory Authentication for GlobalProtect issue
Showing results for 
Search instead for 
Did you mean: 

Active Directory Authentication for GlobalProtect issue

L1 Bithead

Hi !


Currently, I am using GlobalProtect in my network.

Also, I am configuring an Active Directory Server, and I would like to use AD users to connect to GlobalProtect (currently I'm using local users / groups in the firewall). Computers are not in the domain yet.


I have followed this tutorial :


When I verify connection to the LDAP server (with command: show user group name domain\usersgroup1), I've all my users.


But when I try to connect to GlobalProtect with an AD user, it's doesn't work and I have this error message in System logs: Authentification failed : Invalid username or password.


Have you got any idea to solve the problem ?


Thanks all !


This is details of my configuration :


LDAP Server Profile: 



 Group Mapping:

Group Mapping 1.PNG


Group Mapping 2.PNG


This is my Authentification profile :Auth Profile.PNG


Auth Profile 2.PNG


 And this is the GlobalProtect Authentication configuration:

Portal :

Portal Auth.PNG


Portal Auth 2.PNG


 Gateway :

passerelle auth.PNG








L4 Transporter

Very well documented post!


1) If you are entering the domain yourself, under Authentication profile->User domain, then put the user modifier as %username% only.


2) If step (1) doesn't work, then run:


> tail follow yes mp-log authd.log


and then try to authenticate. Copy and paste those logs here.


Good Luck!

ACE 7.0, 8.0, PCNSE 7

L4 Transporter

Hi @informatiq

In the Group Mapping --> Domain Setting --> User Domain, include only your NetBios name or leave it blank, for instance: in your example it is, so leave it as domain


In the Authentication Profile User Domain field, either remove it completely or also include only your NetBios. 


Both actions should resolve this issue for you.


I hope this helps.



L4 Transporter

Use Authentication Sequence profile instead of separate local and LDAP logins, and remove the user domain from the group mapping & auth profile.




Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!