LDAP Authentication for Global Protect

[mario11584]

I am new to LDAP so I'm looking for some help. I have Global Protect setup to authenticate via LDAP using the following:

base: ou=People,dc=company,dc=com

bind DN: uid=fs01,ou=Special Users,dc=company,dc=com

This works. I've confirmed via the system logs.

I'd like to have the PA firewall authenticate ONLY users within a specific LDAP group:

dn: cn=vpn,ou=Groups,dc=company,dc=com

I've played around with group mappings under user identification but I honestly don't know what I am doing or what the fields are asking for and I can't find any documentation that provides any examples.

Any ideas or thoughts are appreciated.

[panos]

Hi,

In group mapping settings try to add some groups which you'll write security rules or etc. to the right panel of this screen.

After commit look for the security rule, users tab.Try to navigate users and look if the groups which you've selected will come or not

if you see the group no problem.Go through Auth. profile(LDAP server is selected inside this) and select the group you want to allow inside the profile.

Then you can use this profile for Global protect portal and gateway.

[Hithead]

Hi,

find in the attachment some screenshots. It should work with this configuration...

[mario11584]

Hmmm....that didn't seem to do the trick. I don't have a Windows environment, it's just Linux using 386 LDAP. Do I have to have a log in attribute under the authentication profile, or is the sAMAccountName attribute for only Active Directory?

[mario11584]

I should probably add my screenshots to show you what I have.

[Hithead]

Sorry, i'm not familar with linux...But...

In your LDAP Server Profile: Try it with your domain name! For example (how it is in my configuration): your domain is mydomain.net -> MyDomain should be the entry. And check the System logs.

(...Also to verify/test your LDAP Profile you can add an administrator account with your LDAP profile(be carefull with capital and lower case username)...)

[mario11584]

Thanks for your help with this. I'll try putting in a domain, but our network doesn't live on a domain. This seems to always throw PA support a curve ball when working on issues like this. We don't have a single windows server anywhere in any of our offices. Not my idea, but it is what it is.

[mario11584]

Adding the domain didn't do the trick.

[sgonzalez]

Try changing your base to just  "dc=company,dc=com" so your search covers both People and Groups. Groups and People are at the same level based on your notes so setting the base to People you can't find the groups in your query.

Restriction to the group you want to use is based on the "Allow list" entry in your Authentication Profile - just like you have it.

Not sure if your login attribute should be sAMAccountName or uid though.  Depends on what designates the user logon id in your ldap setup.

[mario11584]

I gave it a try with just "dc=company,dc=com" and with both login attributes of sAMAccountName and uid, and neither worked. I might just create a new user and test with that. Maybe it's something stupid like a bad password or something (which I have already tried but I'll give it another whirl).

When I try to log in the system logs show the authentication fails because the user is not in the allow list. Does that indicate LDAP is searching the vpn group or is that just a generic LDAP authentication failure message?

[sgonzalez]

Not really sure which logs you are looking at - PAN or LDAP.  If the error is in the PAN logs it is not liking the allow entry for the group.

I found this article but not sure it will help:  https://live.paloaltonetworks.com/message/18184#18184

Other than that I would try a basic ldap browse/query tool to test the lookup of the user in the specified group or open a ticket with PAN and let them take a look.

Sorry,

Steve