GlobalProtect with MultiDomain AD (forest AD)

Reply
Highlighted
L4 Transporter

GlobalProtect with MultiDomain AD (forest AD)

Hi All,

 

For the last couple of days am trying to configure the firewall for one of our customers to use AD authentication for GlobalProtect. But there is a catch, actually two:

- Customer is using MultiDomain (forest) AD, where the users are in one of the sub-domains, while the user group used for allowed users (and policy matching) is in the root domain

- Customer has users that have same samAccountName accross  the sub-domains

 

Using the following articals I manage to configure the LDAP profiles and Group-mapping profiles to work with the AD forest.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGICA0

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClI8CAK


For that reason the Auth profile is configured with empty domain and userinput modifier set to %USERDOMAIN%\%USERINPUT%

 

Now the user group and it members are:
rootdomain\vpn_users
1 sub-domain1\user1
2 sub-domain1\user2

When user enter the his credentials with the sub-domain (ex. sub-domain1\user1) he is successfully authenticated and then allowed to login. And the log record contain that sub-domain1\user1 has logged in.

 

So far so good. My problem now is that one person can have users in two different sub-domains:

sub-domain1\user1

sub-domain2\user1

 

Since my auth profile is using the LDAP profile with baseDN = rootdomain, the searchRequest during user login is searching for the samAccountName in the all domains, and it seems that firewall is first returning the one from the wrong domain. (ex. search return sub-domain2\user1, but group-mapping require sub-domain1\user1).

 

That is why I have configured different LDAP profiles that has differnt baseDN, for each sub-domain. I have configure different auth profile for each and put them in Auth. sequence.

 

And here comes the real problem. The auth. sequence has option to use the domain to select with profile to use, if no match found it starts top-to-bottom. However If I put a domain in the auth. profile the searchRequest tries to filter for samAccountName=sub-domain1\user1, which is failing. If I remove the domain from auth. profile search is correct - samAccountName=user1, but in this case the auth sequence is not using the domain entered by the user and try the profiles from top to bottom.

 

So the question is:
How to tell authentication sequence which profile to use, based on the domain entered by the user, without sending the "domain\" along with the user input?

 

I know that explanation is a bit of a mess, but I hope it is clear enough to understand my question :D

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!