users not able to login via LDAP

[kunal_19]

Hi All,

I am stuck in a situation.

I need my users to access PA GUI only when it is authenticated by LDAP server. Configured following :-

1. LDAP server profile

2. Created authentication profile

3. made a user by name xxx and bind auth. profile with it.

4. test authentication with CLI is also successfull.

Except admin nobody is able to login . any suggestions ?

[reaper]

did you set the UserDomain in the authentication profile to match your domain? have you tried changing the Username Modifier ?

[kunal_19]

yes tried all possibilities but cant login

[TranceforLife]

Hi,

Can you talk to the LDAP server (pinging the server, port 636  (SSL) and 389)

I followed this article and everything  was working for me:

https://live.paloaltonetworks.com/t5/Configuration-Articles/Using-LDAP-to-Authenticate-to-the-Web-UI...

[acc6d0b3610eec313831f7900fdbd235]

Hi @kunal_19

Here an example of how I have configured my LDAP profile to allow administrators to login into the firewall with their LDAP/AD credentials.

1. One of the important parts to add to the profile is your sAMAccountName attribute and your Username domain (Only the NetBios portion).

2. In the Advanced tab, add the AD group or usernames you want to authorize to use this profile. I am sure you have done that as well, but make sure to add the username to the local administrators list if you want the user to have admin rights in the firewall.

I also always try to ensure that the firewall has an updated LDAP query from AD. What I mean by that is by going to the CLI and running the following command: show user user-ids and it will show all your users and the AD groups they belong to. Make sure that the firewall has the lastest updated query.

I hope this helps. 😉

Follow me on twitter: @willguibr

[kunal_19]

Hello Guys,

Thank you all for suggesting me different methods and guess what , I am now able to authenticate.

Any idea how it is working now ? You won't believe :-- I dint check the " administrator use only checkbox in ldap server settings".

Screenshot below:-

[TranceforLife]

Hi,

My profile still works without:

[acc6d0b3610eec313831f7900fdbd235]

@TranceforLife
The same here 🙂

[TranceforLife]

I think we must confirm connectivity first on the specified ports, then it should just work 😄