I am attempting to configure Global Protect to authenticate with our LDAP server. We are an all Linux shop and we are using LDAP 389, which is very similar to OpenLDAP (this is what I was told anyway, I am not much a server guy and don't manage this server). We would like just one specific group and the users assigned to that group to be allowed to authenticate. To do this we have attempted to setup a group mapping but we're having a heck of a time coming up with the right filters, object classes, etc. to get this to work completely. Does anybody have experience with this LDAP server that can throw me a bone? I've worked with Palo Alto support and they have worked diligently to help me figure it out but they haven't had much luck either. I pulled up the group (vpn) using an LDAP browser and attached a screenshot of the details. Currently I have the following configured under Group Objects: Search filter: (empty) Object Class: top Group Name: cn Group Member: vpn User Objects: Search filter: (empty) Object Class: top User Name: uid With these configs I am able to see the groups listed under the Group Include List and add it to the Included Groups, which allows me to add it to the allowed users list under the authentication profile, however I am unable to authenticate when testing. System logs show the user is not in the allowed user list. When I use the show user group list command in the CLI it shows me the group I want to add. When I use the show user group name "groupname" command to see all the users in the group it doesn't show me the users. It just shows me the groups short name, source type, and source. It seems like the group is queried but not the users. Any thoughts?
... View more
