firewall using wrong LDAP attribute to find user in active directory

[Carracido]

Hello Community,

I´d like to check with you the following issue:

created a LDAP authentication profile which is not working, when using the "test.... " command I get an authentication failed with "Received empty DN for user User12345"

I made a traffic capture and saw that the firewall is using the wrong attribute to find the user on the active directory. The firewall is using the "uid" attribute to authenticate the user but PAN firewalls can use only the following login attributes for LDAP authentication:
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClogCAC

If I have the "sAMAccountName" login attribute in my authentication profile, why is the firewall even trying to search the active directory with "uid" attribute? Any idea?

Thank you,

Carracido. 

[Remo]

Hi @Carracido 

Is your LDAP server profile configured correctly? Do you use the LDAP profile also for User-ID group mapping settings and if yes, does it work there correctly? Did you set the type to active-directory?