FreeIPA LDAP group mapping

Reply
Highlighted
L0 Member

FreeIPA LDAP group mapping

UPDATED:

The LDAP package FreeIPA uses , 389-ds-base, had some security vulunerabilities and has been updated. This update has caused the PA to fail checking users within groups. Here's is the latest configuration that works with 389-ds-base (1.3.8.4-15.el7.x86_64)Ive tried many parameters trying to connect to FreeIPA for LDAP group mapping and finally found the right config, here it is. The 'x' values in the User Attributes are required, the value itself does not matter just as long as the attribute itself is being used

FreeIPACapture1 (1).GIFFreeIPACapture2 (1).GIF

 

 

Tags (1)
Highlighted
L0 Member

Hello @blachance,

 

We are trying to connect our Palo Alto to our FreeIPA for the userID part.

I wanted to know what settings you have configured at the LDAP level, Authentication Profile and User Identification/Group Mapping Settings?

 

Thank you for your help!

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!