Active Directory Authentication for GlobalProtect issue

Reply
Highlighted
L1 Bithead

Active Directory Authentication for GlobalProtect issue

Hi !

 

Currently, I am using GlobalProtect in my network.

Also, I am configuring an Active Directory Server, and I would like to use AD users to connect to GlobalProtect (currently I'm using local users / groups in the firewall). Computers are not in the domain yet.

 

I have followed this tutorial : https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-Active-Directory-Server....

 

When I verify connection to the LDAP server (with command: show user group name domain\usersgroup1), I've all my users.

 

But when I try to connect to GlobalProtect with an AD user, it's doesn't work and I have this error message in System logs: Authentification failed : Invalid username or password.

 

Have you got any idea to solve the problem ?

 

Thanks all !

 

This is details of my configuration :

 

LDAP Server Profile: 

Server LDAP.PNG

 

 Group Mapping:

Group Mapping 1.PNG

 

Group Mapping 2.PNG

 

This is my Authentification profile :Auth Profile.PNG

 

Auth Profile 2.PNG

 

 And this is the GlobalProtect Authentication configuration:

Portal :

Portal Auth.PNG

 

Portal Auth 2.PNG

 

 Gateway :

passerelle auth.PNG

 

 

 

 

 

 

Highlighted
L4 Transporter

Very well documented post!

 

1) If you are entering the domain yourself, under Authentication profile->User domain, then put the user modifier as %username% only.

 

2) If step (1) doesn't work, then run:

 

> tail follow yes mp-log authd.log

 

and then try to authenticate. Copy and paste those logs here.

 

Good Luck!

================================================================
ACE 7.0, 8.0, PCNSE 7
L4 Transporter

Hi @informatiq

In the Group Mapping --> Domain Setting --> User Domain, include only your NetBios name or leave it blank, for instance: in your example it is domain.ad, so leave it as domain

 

In the Authentication Profile User Domain field, either remove it completely or also include only your NetBios. 

 

Both actions should resolve this issue for you.

 

I hope this helps.

 

Willian

Highlighted
L4 Transporter

Use Authentication Sequence profile instead of separate local and LDAP logins, and remove the user domain from the group mapping & auth profile.

 

Regards,

Sharief

Regards,
Sharief
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!