What kind of problems will I run into if I use Mac OS X server Open Directory?

Reply
Highlighted
L1 Bithead

What kind of problems will I run into if I use Mac OS X server Open Directory?

I have PAN-OS 4.1 and am wondering if I will run into any problems trying to implement user-id, authentication, etc with OS X Open Directory?


Accepted Solutions
Highlighted
L7 Applicator

Re: What kind of problems will I run into if I use Mac OS X server Open Directory?

User Identification in PAN-OS comprises of two pieces:

1. User-Group mapping.

2. User-ip mapping

While you may be able to achieve #1 using LDAP to pull group mapping on the PAN device, the userID agent (used for getting user-ip mapping #2) itself does not work with Mac OS X Server to pull user-ip mappings.

View solution in original post


All Replies
Highlighted
L7 Applicator

Re: What kind of problems will I run into if I use Mac OS X server Open Directory?

User Identification in PAN-OS comprises of two pieces:

1. User-Group mapping.

2. User-ip mapping

While you may be able to achieve #1 using LDAP to pull group mapping on the PAN device, the userID agent (used for getting user-ip mapping #2) itself does not work with Mac OS X Server to pull user-ip mappings.

View solution in original post

Highlighted
L1 Bithead

Re: What kind of problems will I run into if I use Mac OS X server Open Directory?

Is there any work being done to support user-id and OS X open directory in the future?

Highlighted
L7 Applicator

Re: What kind of problems will I run into if I use Mac OS X server Open Directory?

Please get in touch with your regional Palo Alto Networks SE to get more information related to new features and future PAN-OS releases. They can also file a feature request on your behalf if there isnt already one.

Highlighted
L3 Networker

Re: What kind of problems will I run into if I use Mac OS X server Open Directory?

I have a client in the same dilemma.  They are all Mac using Apple Servers running Open Directory to handle user authentication and profiles.

What I've found is that the Open Directory server does not log user login / logout information so there is nothing in syslog on the Open Directory server to support User to IP Mapping.  This is a change that Apple implemented, I think, in 10.8 Server.  So the user login is only recorded on the local computer.  I also haven't found a way to enable user login logging on the Open Directory server.

My client is considering using Open Directory for handling user profiles and using Active Directory to handle user authentication just to be able to get user to IP mapping info.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!