LDAP auth for the WEB UI access clarification

[myky]

Hi All,

Why do we need step 3 mentioned in the KB below for the WB UI authentication with LDAP?:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGuCAK

Why do we need to create a local user? Won't Palo be an LDAP proxy (grabbing username/password and verifying it against LDAP server database)?

[Mark_Brook]

Palo Alto uses a more secure mentality for the Admin users on the firewalls. Calling out the users specificly is a lot more secure they refrenceing an AD group. Anyone with the right AD privlages could modify the AD group and give themselves superuser access to the firewalls. 

[myky]

@Mark_Brook  thanks, it makes sense. So what is PA actually verifying, just AD membership group and not username/password?

[Mark_Brook · Accepted solution]

Its verifying Username(both places), Password, and if you configured a group in your Ldap profile it will do that as well. 

[myky]

Cool, so the local user is another (additional) check as you mentioned earlier. Thanks. 

[BrandonWright]

Palo Alto only has this requirment for LDAP Authentication only when managing the device.  You can use a RADIUS server with RADIUS authentication profile to allow management by AD group, and that works fine, so if you have Microsoft IAS, or other RADIUS server, that will work for allowing a group to authenticate to the firewall and/or panorama.

[myky]

@BrandonWright  this now clear as day (but not a typical day in UK 🙂