What kind of problems will I run into if I use Mac OS X server Open Directory?

[bigtone]

I have PAN-OS 4.1 and am wondering if I will run into any problems trying to implement user-id, authentication, etc with OS X Open Directory?

[goku123 · Accepted solution]

User Identification in PAN-OS comprises of two pieces:

1. User-Group mapping.

2. User-ip mapping

While you may be able to achieve #1 using LDAP to pull group mapping on the PAN device, the userID agent (used for getting user-ip mapping #2) itself does not work with Mac OS X Server to pull user-ip mappings.

[bigtone]

Is there any work being done to support user-id and OS X open directory in the future?

[goku123]

Please get in touch with your regional Palo Alto Networks SE to get more information related to new features and future PAN-OS releases. They can also file a feature request on your behalf if there isnt already one.

[CafNetMatt]

I have a client in the same dilemma.  They are all Mac using Apple Servers running Open Directory to handle user authentication and profiles.

What I've found is that the Open Directory server does not log user login / logout information so there is nothing in syslog on the Open Directory server to support User to IP Mapping.  This is a change that Apple implemented, I think, in 10.8 Server.  So the user login is only recorded on the local computer.  I also haven't found a way to enable user login logging on the Open Directory server.

My client is considering using Open Directory for handling user profiles and using Active Directory to handle user authentication just to be able to get user to IP mapping info.