11-08-2018 02:12 AM
Hi All,
For the last couple of days am trying to configure the firewall for one of our customers to use AD authentication for GlobalProtect. But there is a catch, actually two:
- Customer is using MultiDomain (forest) AD, where the users are in one of the sub-domains, while the user group used for allowed users (and policy matching) is in the root domain
- Customer has users that have same samAccountName accross the sub-domains
Using the following articals I manage to configure the LDAP profiles and Group-mapping profiles to work with the AD forest.
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGICA0
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClI8CAK
For that reason the Auth profile is configured with empty domain and userinput modifier set to %USERDOMAIN%\%USERINPUT%
Now the user group and it members are:
rootdomain\vpn_users
1 sub-domain1\user1
2 sub-domain1\user2
When user enter the his credentials with the sub-domain (ex. sub-domain1\user1) he is successfully authenticated and then allowed to login. And the log record contain that sub-domain1\user1 has logged in.
So far so good. My problem now is that one person can have users in two different sub-domains:
sub-domain1\user1
sub-domain2\user1
Since my auth profile is using the LDAP profile with baseDN = rootdomain, the searchRequest during user login is searching for the samAccountName in the all domains, and it seems that firewall is first returning the one from the wrong domain. (ex. search return sub-domain2\user1, but group-mapping require sub-domain1\user1).
That is why I have configured different LDAP profiles that has differnt baseDN, for each sub-domain. I have configure different auth profile for each and put them in Auth. sequence.
And here comes the real problem. The auth. sequence has option to use the domain to select with profile to use, if no match found it starts top-to-bottom. However If I put a domain in the auth. profile the searchRequest tries to filter for samAccountName=sub-domain1\user1, which is failing. If I remove the domain from auth. profile search is correct - samAccountName=user1, but in this case the auth sequence is not using the domain entered by the user and try the profiles from top to bottom.
So the question is:
How to tell authentication sequence which profile to use, based on the domain entered by the user, without sending the "domain\" along with the user input?
I know that explanation is a bit of a mess, but I hope it is clear enough to understand my question 😄
