LDAP Authentication not working when using include group settings

[tamilvanan]

Hi Team,

We had configured LDAP authentication on Palo alto firewall.

The LDAP server had been configured and we had checked the connectivity and it was successful. Created an group mapping and included an group in the include group mapping. 

Checked the groups and the user details via CLI of the firewall and could see that the user under the included group configurations is  being fetched by the firewall.

When configuring authentication profile we could see that the group is included in the authentication profile but the user in the group is not being authenticated but when the allow list is selected as all under the authentication profile the Authentication is happening properly.

Regards,

Tamilvanan.

[OtakarKlier]

Hello,

What I have seen is that somethings dont like nested groups. List the groups by itself and not nested and see if it works.

Regards,

[TomYoung]

Hi @tamilvanan ,

Does the username format in the "show user ip-user-mapping all" command match the username format in the "show user group name cn=blah,cn=blah,dc=blah,dc=blah" command?  (The "show user group list" command will give you the exact group name for the previous command.)  If the format does not match exactly, then the user may not be matched to the group.  There are some things you can do to fix the issue:

1. Make sure the domain specified under Device > Authentication Profile > [LDAP Authenticaton Profile] > Authentication > User Domain matches the domain under Device > User Identification > Group Mapping Settings > [edit] > Server Profile.
2. Follow the guidelines in this doc -> https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-new-features/user-id-features/support-for-multip....  The primary and alternate usernames can fix it as well as the matching without domains if the domain is different or missing.

Thanks,

Tom

[tamilvanan]

Hi @OtakarKlier @TomYoung  Thanks for providing your valuable inputs.

After posting this issue I was searching for documentation on this issue and came across the doc mentioned .

On the Authentication profile and Group mapping settings we had defined abc.com the full DNS name in the domain box. We had modified it to abc on both Group mapping and the Auth profile and the users in that particular groups started getting authenticated when testing using the test auth-profile command.

Global Protect Login Fails When Using a Group in the Allow List

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClizCAC

[TomYoung]

Hi @tamilvanan ,

That's exactly what I said in #1 above!  Glad you got it working.  BTW, your URL points to webdefense.  You may want to fix it.

Thanks,

Tom