cli access with email usernames

[samisu]

Has anyone been able to authenticate to the CLI using a username such as username@domain.com over SSH using TACACS+ as authentication. Authenticating using the WebUI works fine, but when you try to SSH using ssh username@domain.com@ipaddress it just sends you back to the username screen. ( user is a superadmin role)

[aleksandar.astardzhiev]

Hi @samisu,

- What do you mean by "back to username screen"? Do you mean password prompt"

- I was thinking that two "@" could confuse the ssh command and it is not able to identify which part is username and which hostname, but I just test it and it seems it shouldn't be a problem. However just for the test, try to connect with "ssh -l username@domain.com ipaddress"

- What firewall system logs are showing when you try to login with ssh? Does it show the whole username "username@domain.com"?

On other hand - do you really need for the user to enter domain when accessing firewall management? If your TACACS is expecting username in the form of "username@domain.com", you can create Authentication Profile that will append the domain to the user input

[BPry]

@samisu,

This should work just based off of a quick test that I did as long as they SSH client being utilized isn't escaping anything. When you look at the logs (System -> (subtype eq auth)) do you see the proper user being submitted? 

[samisu]

@aleksandar.astardzhiev so I just test what you suggest with the ssh -l its the something. I can to screen prompting me to enter the password as soon as I enter the password the screen goes back to username@domain.com@ipaddress password:  and if I enter the password again I get a connection closed by ip address port 22. I think think the problem here is how its setup on the TACACS side.

As for the need, there are multiple domains and we have admins on different domains.

[samisu]

there is no logs in the PAN device showing any successful authentication. The logs from the TACACS server show it authenticated successfully. This points me to what I was thinking before. There is some type of miss configuration on the TACACS side. Thank you!