GP portal error

[Mohammed_Yasin]

Restriction of the users on the GP portal page.

We selected a particular group in the allowed list, but authentication was failing unless we select all.

[Mick_Ball]

from cli... type

show user group list

then type 

show user group name "name of the group required"

check that the users are all in the group as expected and also check the domain\username  is the same domain as auth profile user domain setting.

try that for starters...

[aleksandar.astardzhiev]

Hi @Mohammed_Yasin ,

Almost every time I have seen this behaviour it is caused by differences how the group mapping is reporting the users and how the authentication profile is logging the username - mainly in the domain.

If your authentication profile is accepting only username (without domain) as user input, while the group mapping is returning domain/username.

@Mick_Ball  already give you steps how to check what format are you receiving from group mapping.

[Remo]

Do you restrict the users directly in the portal configuration or in the authentication profile?

If you use the portal configuration, were you able to choose the group from the dropdown? If not, did you also try to enter the DN of the group (all lowercase)?

[Mohammed_Yasin · Accepted solution]

My Actual Issue,

GlobalProtect Portal or Agent users fail authentication

My Authentication Profile has specific filtered groups. The users appear to be in the group that makes up the allow list. However, the message "user not in allow list" still appears. If the allow list is changed to have "all" rather than specific groups, the user authenticates fine.

And I followed this link https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClizCAC