User-ID with OpenLDAP

[raphael_chevalier]

Hi,

I'm looking for a guide or guidelines on how to set-up User Identification with OpenLDAP. I've already set-up User-ID with Active Directory for an other customer but I fail to see how this is doable on a non-Windows machine (no PAN agent).

Any help appreciated.

Regards,

Raphaël

[mbutt]

Hi,

Here is a doc that i found which might be helpful in configuring user identification with openLDAP.

https://live.paloaltonetworks.com/docs/DOC-3434

Hopefully this helps.

Thank you

Numan

[goku123]

-The existing LDAP server profile->Group mapping setup can be used to retrieve user<->group mapping information. However, for submitting user-ip information to the agent, you would have to possibly look into using the userID API to submit user-ip mappings to the agent. The DevCenter community would contain more information on such solutions. The idea is to look for username & ip address information in some log on the server and have the log event trigger a submit to the UserID agent via the API using OpenSSL.

Here is a sample:

Step 1: Connect to the agent on the configured API port:

$ openssl s_client -connect 172.17.132.52:25554

CONNECTED(00000003)

Step 2: Once, connected, submit the user-ip mapping as:

<uid-message>

    <version>1.0</version>

<type>update</type>

    <payload>

          <login>

              <entry name="pantac\user1" ip="192.168.135.200"/>

</login>

          <logout>

          </logout>

    </payload>

</uid-message>

If the mapping is accepted by the agent, following success message is reported back:

<uid-response><version>1.0</version><code>0</code><message>ok</message></uid-response>

[DelvinC]

Seems like its been years since this question was asked. 

Just wanted to know whether there is a different alternative for User-ID with OpenLDAP. Also, I could not access the article linked in the previous response. 😞 

[Pablo-Molina]

Hi folks,

Is possible to integrate User-ID Agent with Open LDAP?

Reviewing release notes for 10.2 User-ID Agent version I can view that it supports for eNovell Directory, but nothing information about Open LDAP