User-ID with OpenLDAP

Reply
Highlighted
Not applicable

User-ID with OpenLDAP

Hi,

I'm looking for a guide or guidelines on how to set-up User Identification with OpenLDAP. I've already set-up User-ID with Active Directory for an other customer but I fail to see how this is doable on a non-Windows machine (no PAN agent).

Any help appreciated.

Regards,

Raphaël

Tags (2)
Highlighted
L5 Sessionator

Hi,

Here is a doc that i found which might be helpful in configuring user identification with openLDAP.

https://live.paloaltonetworks.com/docs/DOC-3434

Hopefully this helps.

Thank you

Numan

Highlighted
L7 Applicator

-The existing LDAP server profile->Group mapping setup can be used to retrieve user<->group mapping information. However, for submitting user-ip information to the agent, you would have to possibly look into using the userID API to submit user-ip mappings to the agent. The DevCenter community would contain more information on such solutions. The idea is to look for username & ip address information in some log on the server and have the log event trigger a submit to the UserID agent via the API using OpenSSL.

Here is a sample:

Step 1: Connect to the agent on the configured API port:

$ openssl s_client -connect 172.17.132.52:25554

CONNECTED(00000003)

Step 2: Once, connected, submit the user-ip mapping as:

<uid-message>

    <version>1.0</version>

<type>update</type>

    <payload>

          <login>

              <entry name="pantac\user1" ip="192.168.135.200"/>

</login>

          <logout>

          </logout>

    </payload>

</uid-message>

If the mapping is accepted by the agent, following success message is reported back:

<uid-response><version>1.0</version><code>0</code><message>ok</message></uid-response>

Highlighted
L2 Linker

Seems like its been years since this question was asked. 

Just wanted to know whether there is a different alternative for User-ID with OpenLDAP. Also, I could not access the article linked in the previous response.  

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!