user-ID user mapping problems

[SimasK]

Our PA 4.1 has problems mapping entries received from user-ID agent and LDAP queries.

show user ip-user-mapping command produces following output:

192.168.1.1 AD        grybai\vltr12345678

Here grybai is our NetBIOS domain name for domain and  vltr12345678 is sAMAccountName attribute of user object in LDAP.

However command show user user-IDs (which shows information received by PA from LDAP queries) for the same user shows:

tadas.blinda@grybaiagrupe.eu    vsys1   cn=b8710 users,ou=email,ou=groups,dc=corp,dc=grybaigroup,dc=eu

where tadas.blinda@grybaiagrupe.eu is userPrincipalName attribute for the same user.

During policy configuration PA web interface gives list of users in tadas.blinda@grybaiagrupe.eu , however such policy doesn't match traffic for that user. Policy with group also doesn't match traffic for that user.

If add policy with grybai\vltr12345678 user (I have to manually type user name during policy configuration), it matches traffic for that user.

LDAP server is configured as type active-directory, under "Group mapping settings" username field is configured as sAMAccountName (default). Tried to change that value with no lock.

Any ideas how to fix it?

[supportOCA]

For the group errors;

In the LDAP config, under active directory name, make sure this setting is in NETBIOS format not DNS name.

eg DOMAINNAME and not domainname.com

[SimasK]

In the User-ID_Upgrade_4.1 it is quite clearly noted not configure any domain unless device is working in multidomain environment, so we don't configured any. Before posting this post I tried to configure both netbios and dns domains without any luck.

[Interface]

Did You resolve this issue? I have same problem..