10-06-2017 06:10 AM
No matter how many articles I read or follow I can never get the authentication to work for LDAP. I create the LDAP server profile, create the Auth Profile, then the Auth Seq, add the user account to admins and assign the profile to that user and it never works. I also get this error when "testing":
admin@PA500-01> test authentication authentication-profile Palo_Alto_Admins username Steven.Williams.da password
Enter password :
Allow list check error:
Target vsys is not specified, user "Steven.Williams.da" is assumed to be configured with a shared auth profile.
Do allow list check before sending out authentication request...
User Steven.Williams.da is not allowed with authentication profile Palo_Alto_Admins
admin@PA500-01>
!
!
!
dmin@TN-19023-PA500-01> show user group-mapping state all
Group Mapping(vsys1, type: active-directory): Network_Administrators
Bind DN : ldap.read@domain.lan
Base : DC=domain,DC=lan
Group Filter: (None)
User Filter: (None)
Servers : configured 4 servers
10.100.6.205(636)
Last Action Time: 19 secs ago(took 0 secs)
Next Action Time: In 41 secs
10.100.6.210(636)
10.100.21.210(636)
10.110.6.210(636)
Number of Groups: 1
cn=paloaltoadmins,ou=groups,ou=domain,dc=domain,dc=lan
admin@PA500-01>
!
!
!
10-11-2017 08:30 AM
according to cli output the auth is working for ldap.
so have we solved the first part of the problem, recognising users and groups for auth profiles.
if so then the username must match exactly on local database as these are case sensitive.
10-11-2017 08:36 AM
In what world are usernames case sensitive!!! Well it works now! Man, 2 weeks of my life gone! Totally going to have to document this overly complicated process...
Thanks for the time and patience!
10-11-2017 08:40 AM
the world of rebadged junipers, such a world that you cannot have spaces in names either.
i think you got stuck in a bit of a loop. just remember to use the netbios name of your domain and not a.b.c.com
glad you got it sorted.
laters...
10-11-2017 08:42 AM
Whoa, wait...so any security groups in AD that have spaces are going to give me issues??
10-11-2017 08:48 AM
no, only if you need to match them to local palo accounts.
local palo accounts cannot have spaces.
i assume you only need this local account for web gui because for this you need to match a local account.
local accounts are not required for policies etc or globalprotect authentication etc...
if done then best mark this as resolved.
10-23-2017 07:04 AM
Ok now I that I figured out local auth for wed GUI, I can't get it to work the same for Panorama. So what steps are different with that platform? I can only choose the "All" for the auth profile>advanced tab. I am using same LDAP server profile.
10-23-2017 10:52 AM
Ok i have not used this but for panorama its slightly different as it has no group mappings.
under panorama:device groups. You need to make one of the devices the master. And select “store users and groups”
this should cause pan to collect group info from master.
i dont actually use this so keep me informed.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
