Error: pan_ldap_ctrl_search_device(pan_ldap_ctrl.c:1889): user_id database is not bound yet

[Ben-Price]

Hi All,

While troubleshooting a intermittent GP issue, I have noticed the below error repeating in the useridd.log.

I am not sure if this part of the problem or not, but it does look a little worrying. I can still browse AD from the firewall and find groups.

2021-09-20 16:18:10.268 +1000 connecting to ldap://[192.168.1.1]:389 ...
2021-09-20 16:18:10.273 +1000 ldap cfg UserGroupMapping connected to 192.168.1.1:389(index 0)
2021-09-20 16:18:10.327 +1000 Error: pan_ldap_ctrl_search_device(pan_ldap_ctrl.c:1889): user_id database is not bound yet

I can also see groups mapped when I run the below command:

>show user group-mapping state all

Performing the below commands hasn't seemed to help either:

> debug user-id reset group-mapping all

>debug software restart process user-id

User-ID is still functioning in some respect as people are able to authenticate to GP and users are able to access resources through security policy rules where user-id is defined.

Any ideas on how to resolve this error?

Thanks in advance.

[Ben-Price]

@BPry @reaper Any ideas here?

[Joshan_Lakhani]

@Ben-Price 

Did this issue resolved. As iam also facing same issue.

[Ben-Price]

@Joshan_Lakhani No sorry it was never resolved. Still pending.

[Ramakrishnan]

I am also having this issue.

pan_ldap_ctrl_search_device(pan_ldap_ctrl.c:1889): user_id database is not bound yet

When I supply this command seems its pulling and have it in db, It appears to me that, when I created the use names its getting populated in PA, but unable t login in with username 

User Name Vsys Groups
------------------------------------------------------------------
ramslab.local\fwadmin vsys1 cn=administrators,cn=builtin,dc=ramslab,dc=local
cn=domain users,cn=users,dc=ramslab,dc=local
cn=users,cn=builtin,dc=ramslab,dc=local
cn=domain admins,cn=users,dc=ramslab,dc=local
cn=denied rodc password replication group,cn=users,dc=ramslab,dc=local
ramslab.local\azwinadmin vsys1 cn=administrators,cn=builtin,dc=ramslab,dc=local
cn=domain users,cn=users,dc=ramslab,dc=local
cn=users,cn=builtin,dc=ramslab,dc=local
cn=domain admins,cn=users,dc=ramslab,dc=local
cn=group policy creator owners,cn=users,dc=ramslab,dc=local
cn=schema admins,cn=users,dc=ramslab,dc=local
cn=enterprise admins,cn=users,dc=ramslab,dc=local
cn=denied rodc password replication group,cn=users,dc=ramslab,dc=local
ramslab.local\az-linx-vm-2$ vsys1 cn=domain controllers,cn=users,dc=ramslab,dc=local
cn=denied rodc password replication group,cn=users,dc=ramslab,dc=local

[bmaxisback]

I'm getting a similar error. User-ID is set to LDAP (multiple Windows Domain Controllers), they all 3 show connected, but traffic logs do not show the user, causing the traffic to miss the correct security polidy and be blocked. Useridd.log shows : 
useridd.log
2022-04-05 08:52:33
2022-04-05 08:52:33.609 -0400 Error: pan_ldap_ctrl_search_device(pan_ldap_ctrl.c:1872): user_id database is not bound yet

[OtakarKlier]

Hello All,

For me it was groups that were not configured correctly after a major migration.

So it was a misconfiguration basically.

Regards,

[Gab_Petricca]

Hello Brian and all,

I'm getting exactly the same error.

Did to find a fix?

Thanks!

Cheers

[bmaxisback]

@Gab_Petricca Check out this KB article:
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClphCAC 

[Ramakrishnan]

Yes. It got fixed. It was due to one of the Domain controllers is
communicating as expected and another reason found that bind was incorrect.
I would like to do check(re-check once)
Bind name
communication between domain controllers
Service account
Hope that would help to resolve the issue....

[bilal_guclu]

Hi, Ramakrishnan,

how to fixed.  About this subject if you have any documants pls share us. 

We have same issue.  We between different data center Data Redistribution info shared. But including the same AD groups we see some users info, some users not see.

[pedro92]

Hello,

which PAN-OS version are you using? We have the same problem at the moment.
The customer who has the error is using 10.1.7

[bilal_guclu]

Hi Pedro,

We using 10.1.5-h1 version. We couldnt solve this problem.