Use XML API users in policies

[tsauter]

Hallo,

I successfully configured an WLAN-Accesspoint to send users via the xml api.
I can see the users in the log entries but I cannot select the users in particular policies. Looks like the users are not known to the firewall.

Do I need to create local users with the same username? Or how can one use these submitted users in policies?

Thank you.

Regards

[reaper]

Will also need to configure the user identification on the firewall, so policies can be applied

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClRyCAK

[tsauter]

Hello,

thanks for the answer. I read through the KB entry, but I couldn't found how the system learn the users so I can use them in the policy. If I understood correctly, the user agent sync the users between the directory service and the firewall.

But in the case of the XML api there is no user agent available.

Should I just manually create the users? Do the firewall match them together?

Thanks.

[reaper]

in your case you dont need the user agent as you're feeding the system with the API, the rest of the config helps you add groups so you can add these to the policy (only groups are autopopulated, and are easier to use than usernames)

else you will need to type the username manually