FreeIPA LDAP group mapping


Changes to the LIVEcommunity experience are coming soon... Here's what you need to know.

L0 Member

FreeIPA LDAP group mapping


The LDAP package FreeIPA uses , 389-ds-base, had some security vulunerabilities and has been updated. This update has caused the PA to fail checking users within groups. Here's is the latest configuration that works with 389-ds-base ( tried many parameters trying to connect to FreeIPA for LDAP group mapping and finally found the right config, here it is. The 'x' values in the User Attributes are required, the value itself does not matter just as long as the attribute itself is being used

FreeIPACapture1 (1).GIFFreeIPACapture2 (1).GIF



Tags (1)
L0 Member

Hello @blachance,


We are trying to connect our Palo Alto to our FreeIPA for the userID part.

I wanted to know what settings you have configured at the LDAP level, Authentication Profile and User Identification/Group Mapping Settings?


Thank you for your help!

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!