Active Directory Authentication for GlobalProtect issue

[informatiq]

Hi !

Currently, I am using GlobalProtect in my network.

Also, I am configuring an Active Directory Server, and I would like to use AD users to connect to GlobalProtect (currently I'm using local users / groups in the firewall). Computers are not in the domain yet.

I have followed this tutorial : https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-Active-Directory-Server....

When I verify connection to the LDAP server (with command: show user group name domain\usersgroup1), I've all my users.

But when I try to connect to GlobalProtect with an AD user, it's doesn't work and I have this error message in System logs: Authentification failed : Invalid username or password.

Have you got any idea to solve the problem ?

Thanks all !

This is details of my configuration :

LDAP Server Profile: 

 Group Mapping:

This is my Authentification profile :

 And this is the GlobalProtect Authentication configuration:

Portal :

 Gateway :

[ansharma]

Very well documented post!

1) If you are entering the domain yourself, under Authentication profile->User domain, then put the user modifier as %username% only.

2) If step (1) doesn't work, then run:

> tail follow yes mp-log authd.log

and then try to authenticate. Copy and paste those logs here.

Good Luck!

[acc6d0b3610eec313831f7900fdbd235]

Hi @informatiq

In the Group Mapping --> Domain Setting --> User Domain, include only your NetBios name or leave it blank, for instance: in your example it is domain.ad, so leave it as domain

In the Authentication Profile User Domain field, either remove it completely or also include only your NetBios. 

Both actions should resolve this issue for you.

I hope this helps.

Willian

[MohamedSharief]

Use Authentication Sequence profile instead of separate local and LDAP logins, and remove the user domain from the group mapping & auth profile.

Regards,

Sharief