Web UI authentication LDAP fails

[Javith]

Hi All,

I have configured everything correct. But no entry in LDAP server security logs while I try to login paloalto Web UI using LDAP profile.

Here at pan I can retrieve the all group user. I have configured the auth.

Profile to 'all' entry in allow list..tried both domain\username(captive portal working fine with this format) and username alone..Pls suggest

admin@paloalto> tail follow yes mp-log authd.log

2015-11-05 12:35:02.826 +0530 debug:

pan_auth_request_process(pan_auth_state_engine.c:1537): Trying to

authenticate: <profile: "", vsys: "", username "cslworld\paloaltotest">

2015-11-05 12:35:02.827 +0530 debug:

_get_auth_prof_detail(pan_auth_util.c:928): "cslworld\paloaltotest" is an admin user

2015-11-05 12:35:02.849 +0530 Error:

pan_auth_cache_get_admin_authprof(pan_auth_cache_adminusers.c:222): No default auth profile found for username paloaltotest

2015-11-05 12:35:02.849 +0530 Error:

_get_admin_authentication_profile_by_name(pan_auth_util.c:501): No admin auth prof found with the name paloaltotest

2015-11-05 12:35:02.849 +0530 Error:

_get_admin_authentication_profile(pan_auth_util.c:546): No auth prof/vsys is found for admin user "paloaltotest"

2015-11-05 12:35:02.849 +0530 Error:

pan_get_authprofile_n_setting(pan_auth_util.c:1029): Failed to get authentication profile for admin cslworld\paloaltotest

[pankaku]

Can you share the authentication profile that you have created for the authentication to GUI.

[Javith]

Hi Kumar,

I have created the auth. profile in device tab with all entry in allow list as per kb.

what is the auth. profile in device->setup tab?..on PAN-OS 7.0.3

[Javith]

configured as per this KB: https://live.paloaltonetworks.com/t5/Configuration-Articles/Using-LDAP-to-Authenticate-to-the-Web-UI...

[AHlaiel]

make sure that the authentication profile has a login attribute "sAMAcount" which is case sensitive, also when you add a new administrator add it only by username that is available in the LDAP server "note that there is no autocompletion" , the firewall will authenticate this user using the LDAP server.