User-ID & LDAPS service account AD permissions

[S.Cain]

Can someone please tell me what all AD membership permissions are required for a service account for User-ID agent and LDAPS.

[CosminM]

Hello @S.Cain ,

Please find all information that you need here: Create a Dedicated Service Account for the User-ID Agent

[S.Cain]

Thanks. What about for LDAPS integration?

[CosminM · Accepted solution]

User-ID has two components:

• mapping usernames with IP addresses (IP-to-user mapping), and I assume that for this reason you need to configure a service account (Map IP Addresses to Users)
• knowing AD security groups membership (group-mapping), and for this component you need to configure an LDAP Server Profile (inside that you can use LDAP or LDAPS protocol - How to Configure LDAP Server Profile - Knowledge Base - Palo Alto Networks). After you configure Group Mapping Settings that will use your LDAP Server Profile (Map Users to Groups)