Due to some internal department/company shuffling we have a requirement to authenticate a specific subset of our user base via ldap only, bypassing our existing SAML setup. Reading other forum posts and Palo docs I've learned that once you enable SAML on a gateway that's pretty much all you can use, so I'm looking at setting up a secondary gateway for these specific users.
The issue I'm running into is that since Panorama is not able to directly query the Active Directory LDAP servers for group info I am unable to select any AD groups in the gateway agent configs section.
I was hopping that copy/pasting the entire ldap structure for the cn would allow it to show up properly on the managed firewall.
but that just shows up as a string on the actual firewall.
Does anyone have info on how to push this out through Panorama, or is this even possible?
Following back up here, I was on the right path with the full LDAP string in the users section.
tl;dr use the full LDAP query in the user/group setting in GP and DON'T enter the AD domain name in the group mapping settings.
Panorama does not pull the user/group info from LDAP in the GP section so a copy/paste of the LDAP query has to be manually entered. This can be pulled from the Policies tab as MickBall suggested.
The piece that was tripping me up is that we are using SAML for authentication and the user group mapping that was setup prior to myself working in the system had a manually defined domain in the user domain field using the FQDN.
Turns out this was not allowing the firewall to properly match the user account to the group for non-policy mappings. So policies would work just fine, but GP portal and gateway mapping never worked. Removing the domain altogether allowed not only the proper groups to be matched but also enabled Panorma to pull in all of the groups from AD.
Have you not selected a master device in your device groups. or perhaps this does not work for gateways.
Or hows about you just copy the group name from a firewall and paste into Panaorama.
Following back up here, I was on the right path with the full LDAP string in the users section.
tl;dr use the full LDAP query in the user/group setting in GP and DON'T enter the AD domain name in the group mapping settings.
Panorama does not pull the user/group info from LDAP in the GP section so a copy/paste of the LDAP query has to be manually entered. This can be pulled from the Policies tab as MickBall suggested.
The piece that was tripping me up is that we are using SAML for authentication and the user group mapping that was setup prior to myself working in the system had a manually defined domain in the user domain field using the FQDN.
Turns out this was not allowing the firewall to properly match the user account to the group for non-policy mappings. So policies would work just fine, but GP portal and gateway mapping never worked. Removing the domain altogether allowed not only the proper groups to be matched but also enabled Panorma to pull in all of the groups from AD.
