FreeIPA LDAP group mapping

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Please sign in to see details of an important advisory in our Customer Advisories area.

FreeIPA LDAP group mapping

L0 Member


The LDAP package FreeIPA uses , 389-ds-base, had some security vulunerabilities and has been updated. This update has caused the PA to fail checking users within groups. Here's is the latest configuration that works with 389-ds-base ( tried many parameters trying to connect to FreeIPA for LDAP group mapping and finally found the right config, here it is. The 'x' values in the User Attributes are required, the value itself does not matter just as long as the attribute itself is being used

FreeIPACapture1 (1).GIFFreeIPACapture2 (1).GIF




L0 Member

Hello @blachance,


We are trying to connect our Palo Alto to our FreeIPA for the userID part.

I wanted to know what settings you have configured at the LDAP level, Authentication Profile and User Identification/Group Mapping Settings?


Thank you for your help!

  • 1 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!