Dominic Burns wrote:
Also make sure the login name has nothing appended to it and matched the username in the group.
From CLI:
show user group name "nameofgroup"
>> Make sure the name is listed there
tail follow yes mp-log authd.log
Then attempt to login and see if the username that is being received matches the same as the way it is displayed in the group listing.
Dominic
The first command definitely shows all users in the group concerned. [abbreviated and offuscated list] darren@Gate(active)> show user group name domain\vpn-users group short name: domain\vpn-users [...] [15 ] domain\darren.gibbs [...] So, you can see I am in the group, and the firewall recognises I am in the group. Doing the second (I removed myself from the individual allow-list configuration and relied on the AD group membership) got me this Nov 21 13:16:15 pan_authd_service_req(pan_authd.c:2683): Authd:Trying to remote authenticate user: darren.gibbs Nov 21 13:16:15 pan_authd_service_auth_req(pan_authd.c:1174): AUTH Request <'vsys1','VPNUsers','darren.gibbs'> Nov 21 13:16:15 Error: pan_authd_get_sysd_multivsys(pan_authd.c:3606): failed to fetch: NO_MATCHES Nov 21 13:16:15 panauth:user <darren.gibbs,VPNUsers,vsys1> is not allowed Nov 21 13:16:15 pan_authd_process_authresult(pan_authd.c:1318): pan_authd_process_authresult: darren.gibbs authresult not auth'ed Nov 21 13:16:15 pan_authd_process_authresult(pan_authd.c:1342): Alarm generation set to: False. Nov 21 13:16:15 User 'darren.gibbs' failed authentication. Reason: User is not in allowlist From: 110.142.210.164. Nov 21 13:16:15 pan_get_system_cmd_output(pan_cfg_utils.c:3056): executing: /usr/local/bin/sdb -n -r cfg.operational-mode Nov 21 13:16:15 pan_authd_generate_system_log(pan_authd.c:897): CC Enabled=False Nov 21 13:16:15 pan_get_system_cmd_output(pan_cfg_utils.c:3056): executing: /usr/local/bin/sdb -n -r cfg.operational-mode Any further suggestions welcomed.
... View more
