About D_Baerry

I've got a config that is where I want it to be, and works, but seems to indicate there are 2 (possibly related) bugs. Here is the config in a nutshell:   Management Auth RADIUS Auth Profile with the username modifier set to %USERDOMAIN%\%USERINPUT% Allow List in Auth Profile set to Admin Group Group Mapping Profile (pulling from LDAP) set with Primary Username to be sAMAccountName This setup allows me to leave the SAML config alone and login successfully to both SSH and WEBUI.   Potential Bugs: When primary username is set to UserPrincipalName in Group Mappings When Username modifier is set to %USERINPUT%@%USERDOMAIN% the %USERDOMAIN% is not being applied during user mapping check When user enters fully qualified identity for SSH login (Username modifier set to %USERINPUT%) the SSH session terminates right after successful auth ... View more

I also noted the following:   Due to a SAML authentication need, we have the default username set to UPN so that group memberships are seen accurately. When I specify the Username modifier for the RADIUS profile to be %USERINPUT%@%USERDOMAIN%  the allow list check begins failing for the auth profile. Wouldn't it stand to reason the Username modifier should be applied before the group check is performed? Wouldn't it also make sense to honor the alternate username defined in the group mapping settings?   I can get the SSH connection to work by setting the auth profile to allow all, and updating the Username modifier as per the above. This makes me think it doesn't like the format of %USERNAME%@%DOMAIN%@%FW-ADDRESS%. I know SSH can do this format because I've used it in other implementations. The question becomes, how to get the group mappings for SAML and RADIUS to both play nicely on the same domain without querying the groups twice..... for now I have 2 group mapping settings defined, one for SAML and one for RADIUS with the different groups in each.   Opened a ticket and will report back if I find anything else out. ... View more