Global Protect Connectivity Issue

[H.Thiam]

I am deploying GlobalProtect and have configured the Gateway Agent Client Settings with the following Source User in the Config Selection Criteria: connect\vpnusers

I am a member of this group. The group is retrieved from our internal LDAP server via User Identification → Group Mapping, with the following attributes configured:

• Primary Username: sAMAccountName

• Email: mail

Users authenticate to the GlobalProtect portal and gateway using SAML (Duo). The Authentication Profile that references the SAML server profile is configured with the following Username Attribute:

duo_username

The issue I am encountering is that whenever I attempt to connect, GlobalProtect fails with the error: Matching Client Config not found

However, when I change the Source User in the Config Selection Criteria to any, the connection succeeds. This indicates that the issue is specifically related to the user group–based matching.

I strongly suspect there is a username format mismatch between SAML and LDAP. I have tried multiple variations of the username format, but none have resolved the issue.

According to the GlobalProtect logs, the firewall is identifying me as:

user1@connect.com

Can anyone please advise on how to correctly align the SAML and LDAP username formats so that the user is properly matched to the LDAP group and the correct client configuration is applied?

[BPry]

@H.Thiam,

Someone with Duo can probably provide you more information, but it looks like the attribute that Duo wants to utilize would be User.Username for your authentication profile according to their docs

[H.Thiam]

Thanks for the feedback . I have tried the User.Username attribute but  same outcome . I have also come across a recommendation to update the User Domain  and User  Modifier fields within the  SAML authentication profile so it forces the firewall  to match the SAML format to the LDAP group  Mapping  . However those fields are only applicable to the TACACS type . 

[TomYoung]

Hi @H.Thiam ,

I had a similar problem with my GP SAML username format user@domain.com and my LDAP group mapping domain\user.  The users were not matching the groups.  Changing the User Domain under Device > User Identification > Group Mapping Settings > [edit group mapping] > Server Profile > Domain Setting caused the GP SAML usernames to change from user@domain.com to domain\user so that the LDAP groups would work.  All other fields remained the default (except the Update Interval).

Thanks,

Tom