Set up LDAP authentication for GlobalProtect users by creating an LDAP server profile
and an authentication profile to connect to an authentication server and authenticate
LDAP is often used by organizations as an
authentication service and a central repository for user information.
It can also be used to store the role information for application
Create a server
The server profile identifies the external authentication
service and instructs the firewall how to connect to that authentication
service and access the authentication credentials for your users.
you use LDAP to connect to Active Directory (AD), you must create
a separate LDAP server profile for every AD domain.
an LDAP server profile.
If this profile is for a firewall with multiple virtual
systems capability, select a virtual system or
where the profile is available.
area, and then enter the necessary information
for connecting to the authentication server, including the server
IP address or FQDN of the
Select the LDAP server
enable the authentication service to authenticate the firewall.
) If you want the endpoint to use
SSL or TLS for a more secure connection with the directory server,
enable the option to
Require SSL/TLS secured connection
by default). The protocol that the endpoint uses depends on the
389 (default)—TLS (Specifically, the device uses
the StartTLS operation, which upgrades
the initial plaintext connection to TLS.)
Any other port—The device first attempts to use TLS. If the
directory server doesn’t support TLS, the device falls back to SSL.
) For additional security, enable
to the option to
Verify Server Certificate for SSL sessions
that the endpoint verifies the certificate that the directory server
presents for SSL/TLS connections. To enable verification, you must
also enable the option to
Require SSL/TLS secured connection
For verification to succeed, the certificate must meet one of the
It is in the list of device certificates:
necessary, import the certificate into the device.
The certificate signer is in the list of trusted certificate
Trusted Certificate Authorities
to save the server
Create an authentication profile.
The authentication profile specifies the server profile
that the portal or gateways use when they authenticate users. On
a portal or gateway, you can assign one or more authentication profiles
to one or more client authentication profiles. For descriptions
of how an authentication profile within a client authentication
profile supports granular user authentication, see Configure
a GlobalProtect Gateway and Set
Up Access to the GlobalProtect Portal.
If a user’s password expires,
you can assign a temporary LDAP password to enable them to log in
to GlobalProtect. In this case, the temporary password may be used
to authenticate to the portal, but the gateway login may fail because
the same temporary password cannot be re-used. To prevent this issue,
configure an authentication override in the portal configuration (
) to enable the GlobalProtect
app to use a cookie to authenticate to the portal and the temporary
password to authenticate to the gateway.
, and then
for the profile.
Select the LDAP authentication
you created in step 1.
Password Expiry Warning
specify the number of days before password expiration that users
are notified. By default, users are notified seven days prior to
password expiration (range is 1-255). Because users must change
their passwords before the end of the expiration period, you must
provide a notification period that is adequate for your users in
order to ensure continued access to GlobalProtect. To use this feature,
you must specify one of the following LDAP server types in your
LDAP server profile:
Unless you enable pre-logon, users cannot access GlobalProtect
when their passwords expire.
. The endpoint combines the
values to modify the domain/username string
that a user enters during login. The endpoint uses the modified
string for authentication and the
for User-ID group mapping. Modifying user input is useful when the
authentication service requires domain/username strings in a particular
format but you do not want to rely on users to enter the domain
correctly. You can select from the following options:
To send only the unmodified user input, leave the
blank (the default) and set the
to the variable
To prepend a domain to the user input, enter a
and set the
To append a domain to the user input, enter a
and set the
value replaces any domain
string that the user enters. If the
blank, tthe device removes any user-entered domain string.
to select the users and user groups that are allowed
to authenticate with this profile. The
allows every user to authenticate with this profile. By default,
the list has no entries, which means no users can authenticate.