Multiple Domain and domain name

[NomiosSupport]

Hello,

I have deployed 1 cluster of PA 3020(5.0.5) and UIA on 2 servers of the domain.

The domain architecture is as following:

1 parent domain: idf.local

6 child domain: xx.idf.local, yy.idf.local, ...

UIA works well and we have good informations on the PA with NETBIOS domaine name

show user ip-user-mapping all:

IDF\user1

XX\user2

YY\user3

But with the group mapping, it's fqdn domain that appears.

show user group name "cn=ggggggg,ou=fffffffff,dc=idf,dc=local":

idf.local\user1

xx.idf.local\user2

yy.idf.local\user3

LDAP server profile configuration is done with global catalog:

admin@XXXXXX(active)# show shared server-profile ldap profile-AD-GC

profile-AD-GC {

  server {

    gtgt50.idf.local {

      port 3269;

      address 192.168.1.1;

    }

  }

  ldap-type active-directory;

  base DC=idf,DC=local;

  bind-dn "CN=login,......,DC=idf,DC=local";

  timelimit 30;

  bind-timelimit 30;

  bind-password -AQ==SdRlIx0rvZ/zcM4qhyMPexBjphE=Xce5R8I57K7Xi1MRcJdzBg==;

  ssl yes;

}

[edit]                                     

The problem is that I can't create policy based on AD group because there is a mismatch between UIA and Group Mapping information.

Any idea?

Thanks!!

[UhMayYeah]

Can you try using IDF as a domain in the LDAP server profile and refresh the group-mapping :

> debug user-id refresh group-mapping <>

[NomiosSupport]

I have already tried this but it overrides all domain name:

show user group name "cn=ggggggg,ou=fffffffff,dc=idf,dc=local":

IDF\user1

IDF\user2

IDF\user3

The problem is that user2 belongs to XX domain which is the domain child(xx.idf.local).

[ACieszkowski]

Hello,

Try creating separate LDAP Server (port 389 or 636) profiles for the parent domain and each child domain including in the configuration NetBios-style domain name and corresponding base.

In Group Mapping Settings create Group Mapping configuration using every LDAP Server Profile (8 in total).

Hope this helps! Update if it does 😉

Global Catalog is used for identifying membership in Universal Groups.

[VinceM]

As albert_C said, create one ldap profile per server and configure "Domain" in the profile then, domain name will be re-write as you want.

V.