Authentication via LDAP server not sending complete DN name

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Authentication via LDAP server not sending complete DN name

Hi Team,

 

I have configured LDAP server profile and confirmed the condition of reading group via Group mapping it works.

 

When I try to test the LDAP username through authentication profile it succeed upto LDAP authentication but after it is sending DN name only with domain name and my user get failed to authenticate.

 

What else I need to check. 

 

 

test authentication authentication-profile LDAP user name remeskremeshk admin-remeshk@TH-FW-PA3060> test authentication authentication-profile LDAP user name remeshk password
Enter password :
[?1h=
Target vsys is not specified, user "remeshk" is assumed to be configured with a shared auth profile.

Do allow list check before sending out authentication request...
name "trojanholding.ae\remeshk" is in group "all"

Authentication to LDAP server at 10.3.4.10 for user "remeshk"
Egress: 172.25.25.4
Type of authentication: plaintext
Starting LDAP connection...
Succeeded to create a session with LDAP server
DN sent to LDAP server: DC=trojanholding,DC=ae
Authentication failed against LDAP server at 10.3.4.10:389 for user "remeshk"

Authentication to LDAP server at 10.3.4.11 for user "remeshk"
Egress: 172.25.25.4
Type of authentication: plaintext
Starting LDAP connection...
Succeeded to create a session with LDAP server
DN sent to LDAP server: DC=trojanholding,DC=ae
Authentication failed against LDAP server at 10.3.4.11:389 for user "remeshk"


Authentication failed for user "remeshk"

 

6 REPLIES 6

L7 Applicator

when you test LDAP via the test command it does not use all configured parts of the authentication profile. it does not use any domain modifier that you have set.

No it is not like that way, Here I found actually the username is missing the root structure of the domain in AD. 

sorry i am confused, can you show me a test that does work...

admin@PA-VM> test authentication authentication-profile Auth-GP username venkatesan password
Enter password :

Target vsys is not specified, user "venkatesan" is assumed to be configured with a shared auth profile.

Do allow list check before sending out authentication request...
name "venkatesan" is in group "all"

Authentication to LDAP server at 172.16.3.142 for user "venkatesan"
Egress: 192.168.30.1
Type of authentication: plaintext
Starting LDAP connection...
Succeeded to create a session with LDAP server
DN sent to LDAP server: CN=venkatesan r.,CN=Users,DC=abdalla,DC=local
User expires in days: never

Authentication succeeded for user "venkatesan"

ok so now show test that doesn't work.

it works 

  • 3525 Views
  • 6 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!