Global Protect User Groups

[BatD]

I want to user map configuration to AD user group for Global Protect clientless VPN. This works quite will if authentication is LDAP.
Have you any idea how can I get it to work with Radius authentication?  Presuming that the user has the same name as the LDAP user, would they be matched to the relevant AD group?

[SCantwell_IM · Accepted solution]

I would believe so.

I am of the opinion that you are confusing (respectfully) WHAT group a user is a member of vs HOW the user Authenticates.

If the Radius server says the person is authenticated... then he is authenticated... it is the LDAP Grouping that determines what configuration the user will be mapped to.

Excellent question.

What other questions do you have?

Thanks.

[Mick_Ball]

By default... no.

the user fred smiff will not be the same as group member domain\fred smiff.

for this to work you need to add the domain name into the authentication profile.

[SCantwell_IM]

@Mick_Ball   Agreed.

I am making presumption that access to the clientless VPN is based on AD groups, and Auth Profile should already have the correct domain listed. 

Thanks for confirming! 

steve