LDAP profile broken after upgrading to 5.0.10

Announcements

ATTENTION Customers, All Partners and Employees: The Customer Support Portal (CSP) will be undergoing maintenance and unavailable on Saturday, November 7, 2020, from 11 am to 11 pm PST. Please read our blog for more information.

Reply
Highlighted
L3 Networker

LDAP profile broken after upgrading to 5.0.10

Hi,

I upgraded my firewalls to PANOS 5.0.10 yesterday, and after the upgrade the LDAP profile fails with "invalid credentials". I have tried resetting the password for the account used, but the error still persists.

Have anyone else encountered this issue? Experiencing the same issue both on PA-3020 and PA-200, and the error started occuring immediatly after the system was rebooted to running 5.0.10.

Tags (3)

Accepted Solutions
Highlighted
L3 Networker

Bug found in 5.0.10:

I have solved this case. We are a Norwegian company, with a Scandinavian character in our name (ø), and this has been used for the OU containing most of our users, computers and groups.

To see if this could be an issue, I created a new group and moved it to "OU=Users,DC=domain,DC=local", and added it to the group mapping, along with the existing groups which were already present, and located under a OU with ø in it's name.

From CLI, doing "show user group-mapping state "Default groups", the new group was the only one shown, and number of groups was shown as 1, despite over ten groups being added to the group mapping.

Then, doing "show user group name ?", showed the lowercase ø being written as "ø", so all attempts to look up items located under this OU failed. Issue would also occur if the user group name contained the character.

I assume this also goes for other non-English characters, and it did work in all versions prior to 5.0.10 that I have run.

Now I only hope that someone from Palo Alto Networks actually sees this, and that it will be fixed in an upcoming version.

View solution in original post


All Replies
Highlighted
L5 Sessionator

Hi,

Done the upgrade yesterday and no issue ... on both PA500 and PA200.

V.

Highlighted
L3 Networker

I have reset password for the user, and confirmed that the user is able to connect to Active Directory properly from a Windows machine, so this should be OK.

Also did a reboot of one of the firewalls, as well as one of the DC's.

Entire forest is running at 2008 R2 level, and the issues started occuring immediatly after the systems had been rebooted with 5.0.10.

Authentication profile looks like this:

Tried using both using full DN, as well as username@domain.

LDAP_profile.png

Highlighted
L3 Networker

Seems like I got it working now (forgot to update the password in the agent setup under User mapping. Whoops!), but I'm still having issues with rules that allow users based on user group.

I still find it weird that the LDAP suddenly stopped working for each device after rebooting with 5.0.10.

EDIT: I think I found the error. If using the value of distinguishedName as the Bind DN in the LDAP profile, authentication will fail. This has been working fine in previous versions. Using user@domain works.

If I add the user directly, it works just fine. Do I have to wait for a synchronization to run in order for user groups to work properly again?

Did "show user group name "cn=group name,ou=groups,dc=domain,dc=local", and it seems like it should work.

All users are listed as domain\username.

However, if I do "show user ip-user-mapping ip 192.168.10.100", the Group(s) field only show one of the groups my user belongs to.

Highlighted
L3 Networker

Bug found in 5.0.10:

I have solved this case. We are a Norwegian company, with a Scandinavian character in our name (ø), and this has been used for the OU containing most of our users, computers and groups.

To see if this could be an issue, I created a new group and moved it to "OU=Users,DC=domain,DC=local", and added it to the group mapping, along with the existing groups which were already present, and located under a OU with ø in it's name.

From CLI, doing "show user group-mapping state "Default groups", the new group was the only one shown, and number of groups was shown as 1, despite over ten groups being added to the group mapping.

Then, doing "show user group name ?", showed the lowercase ø being written as "ø", so all attempts to look up items located under this OU failed. Issue would also occur if the user group name contained the character.

I assume this also goes for other non-English characters, and it did work in all versions prior to 5.0.10 that I have run.

Now I only hope that someone from Palo Alto Networks actually sees this, and that it will be fixed in an upcoming version.

View solution in original post

Highlighted
L3 Networker

The issue has been submitted to Palo Alto, and a fix is planned for PANOS 6.0.

Highlighted
L4 Transporter

Hello as-mg..
Do you have the bug number for this issue?

/Jo Christian
Highlighted
L3 Networker

Unfortunately, no, as I never had direct contact with Palo Alto Networks, but went through a second company that handles support for us.

However, the issue has not been resolved in 5.0.11 which I installed tonight. Could not see anything in the release notes for PANOS 6.0.0 either, could anyone running this version confirm if it has been resolved or is still an issue?

Highlighted
L0 Member

Hi . We Have the same problems with Russian symbols.

At PanOS 6 issue was not solved =(

Highlighted
L0 Member

Answer from our integrators :

Solving of that problem expected in 5.0.12 and 6.0.2 releases. Release 5.0.12 expected in first part of May , but date may changed by developers team.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!