Set Up LDAP Authentication
LDAP is often used by organizations as an authentication service and a central repository for user information. It can also be used to store the role information for application users.
- Create a server profile.The server profile identifies the external authentication service and instructs the firewall how to connect to that authentication service and access the authentication credentials for your users.When you use LDAP to connect to Active Directory (AD), you must create a separate LDAP server profile for every AD domain.
- Select, and thenDeviceServer ProfilesLDAPAddan LDAP server profile.
- Enter aProfile Name, such asGP-User-Auth.
- If this profile is for a firewall with multiple virtual systems capability, select a virtual system orSharedas theLocationwhere the profile is available.
- ClickAddin theServer Listarea, and then enter the necessary information for connecting to the authentication server, including the serverName, IP address or FQDN of theLDAP Server, andPort.
- Select the LDAP serverType.
- Enter theBind DNandPasswordto enable the authentication service to authenticate the firewall.
- (Optional) If you want the endpoint to use SSL or TLS for a more secure connection with the directory server, enable the option toRequire SSL/TLS secured connection(enabled by default). The protocol that the endpoint uses depends on the server port:
- Any other port—The device first attempts to use TLS. If the directory server doesn’t support TLS, the device falls back to SSL.
- (Optional) For additional security, enable to the option toVerify Server Certificate for SSL sessionsso that the endpoint verifies the certificate that the directory server presents for SSL/TLS connections. To enable verification, you must also enable the option toRequire SSL/TLS secured connection. For verification to succeed, the certificate must meet one of the following conditions:
- It is in the list of device certificates:If necessary, import the certificate into the device.DeviceCertificate ManagementCertificatesDevice Certificates.
- The certificate signer is in the list of trusted certificate authorities:.DeviceCertificate ManagementCertificatesDefault Trusted Certificate Authorities
- ClickOKto save the server profile.
- (Optional) Create an authentication profile.The authentication profile specifies the server profile that the portal or gateways use when they authenticate users. On a portal or gateway, you can assign one or more authentication profiles to one or more client authentication profiles. For descriptions of how an authentication profile within a client authentication profile supports granular user authentication, see Configure a GlobalProtect Gateway and Set Up Access to the GlobalProtect Portal.To enable users to connect and change their expired passwords without administrative intervention, consider using Remote Access VPN with Pre-Logon.If a user’s password expires, you can assign a temporary LDAP password to enable them to log in to GlobalProtect. In this case, the temporary password may be used to authenticate to the portal, but the gateway login may fail because the same temporary password cannot be re-used. To prevent this issue, configure an authentication override in the portal configuration () to enable the GlobalProtect app to use a cookie to authenticate to the portal and the temporary password to authenticate to the gateway.NetworkGlobalProtectPortal
- Select, and thenDeviceAuthentication ProfileAdda new profile.
- Enter aNamefor the profile.
- Set theAuthenticationTypetoLDAP.
- Select the LDAP authenticationServer Profilethat you created in step 1.
- EntersAMAccountNameas theLogin Attribute.
- Set thePassword Expiry Warningto specify the number of days before password expiration that users are notified. By default, users are notified seven days prior to password expiration (range is 1-255). Because users must change their passwords before the end of the expiration period, you must provide a notification period that is adequate for your users in order to ensure continued access to GlobalProtect. To use this feature, you must specify one of the following LDAP server types in your LDAP server profile:active-directory,e-directory, orsun.Unless you enable pre-logon, users cannot access GlobalProtect when their passwords expire.
- Specify theUser DomainandUsername Modifier. The endpoint combines theUser DomainandUsername Modifiervalues to modify the domain/username string that a user enters during login. The endpoint uses the modified string for authentication and theUser Domainvalue for User-ID group mapping. Modifying user input is useful when the authentication service requires domain/username strings in a particular format but you do not want to rely on users to enter the domain correctly. You can select from the following options:
If theUsername Modifierincludes the%USERDOMAIN%variable, theUser Domainvalue replaces any domain string that the user enters. If theUser Domainis blank, tthe device removes any user-entered domain string.
- To send only the unmodified user input, leave theUser Domainblank (the default) and set theUsername Modifierto the variable%USERINPUT%(the default).
- To prepend a domain to the user input, enter aUser Domainand set theUsername Modifierto%USERDOMAIN%\%USERINPUT%.
- To append a domain to the user input, enter aUser Domainand set theUsername Modifierto%USERINPUT%@%USERDOMAIN%.
- On theAdvancedtab,AddanAllow Listto select the users and user groups that are allowed to authenticate with this profile. Thealloption allows every user to authenticate with this profile. By default, the list has no entries, which means no users can authenticate.
- Commit the configuration.ClickCommit.
Recommended For You
Recommended videos not found.