USER-ID Rules

[Sanjay_Ramaiah]

Hi Team,

We have implemented SAML authentication for GP users. Since then the Source User logs are being seen as email IDs and not with the SAMACCOUNTNAME. So the rules implemented with the LDAP user groups are not working. Is there any way we can get this sorted?

Regards,

Sanjay S

[TomYoung]

Hi @Sanjay_Ramaiah ,

What do you have configured for your Primary Username under Device > User Identification > Group Mapping Settings > User and Group Attributes?

That should fix the problem.  If not, there are a couple other options:

1. Many SAML providers allow you to change the username format in their configuration.
2. Normally, you could adjust the User Domain and Username Modifier fields in the authentication profile, but SAML is different.  I wonder if modifying the User Attributes in SAML Messages from IDP would fix it?

Thanks,

Tom

Edit:  Forgot to post URL -> https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-web-interface-help/user-identification/device-us....

[Sanjay_Ramaiah]

Thank you very much Tom for your reply.

In the Group Mapping we have configured the Server Profile with the PrimaryUsername as SAMACCOUNTNAME itself. After we started using SAML it will not check the Group Mappings right so now we are facing this issue.

As you suggested will check at the SAML Provider end to see if we can make some changes. Will keep this chain updated. Thanks again 🙂

[TomYoung]

Hi @Sanjay_Ramaiah ,

If you change the Primary Username to userPrincipalName, then it will list the group members in UPN format.  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000CpgcCAC&lang=en_US%E2%80%A...  The users in the group will match your SAML format.

Maybe you cannot do that because you have other User-ID sources currently working with group mapping.  If this is the case, you are on the right track to get your usernames standardized in the right format.

Thanks,

Tom