Set Up LDAP Authentication

Create a server profile.
The server profile identifies the external authentication service and instructs the firewall how to connect to that authentication service and access the authentication credentials for your users.
When you use LDAP to connect to Active Directory (AD), you must create a separate LDAP server profile for every AD domain.
Select
Device
Server Profiles
and select the
LDAP
profile.
Click
Add
and enter a Profile
Name
, such as GP-User-Auth.
If this profile is for a firewall with multiple virtual systems capability, select a virtual system or
Shared
as the Location where the profile is available.
Select the
Type
of LDAP server.
Click
Add
in the Servers section and then enter the necessary information for connecting to the authentication server, including the server
Name
, IP address or FQDN of the
Server
, and
Port
.
Specify settings to enable the authentication service to authenticate the firewall. Enter the
Bind DN
and
Password
.
If you want the device to use SSL or TLS for a more secure connection with the directory server, select the
Require SSL/TLS secured connection
check box (selected by default). The protocol that the device uses depends on the server
Port
:
389 (
default
)—TLS (Specifically, the device uses the StartTLS operation, which upgrades the initial plaintext connection to TLS.)
636—SSL
Any other port—The device first attempts to use TLS. If the directory server doesn’t support TLS, the device falls back to SSL.
For additional security, select the
Verify Server Certificate for SSL sessions
check box so that the device verifies the certificate that the directory server presents for SSL/TLS connections. To enable verification, you also have to select the
Require SSL/TLS secured connection
check box. For verification to succeed, the certificate must meet one of the following conditions:
It is in the list of device certificates:
Device
Certificate Management
Certificates
Device Certificates.
Import the certificate into the device, if necessary.
The certificate signer is in the list of trusted certificate authorities:
Device
Certificate Management
Certificates
Default Trusted Certificate Authorities
.
Click
OK
to save the server profile.
(
Optional
) Create an authentication profile.
The authentication profile specifies the server profile for the portal or gateways to use when they authenticate users. On a portal or gateway, you can assign one or more authentication profiles in one or more client authentication profiles. For descriptions of how an authentication profile within a client authentication profile supports granular user authentication, see Configure a GlobalProtect Gateway and Set Up Access to the GlobalProtect Portal.
To enable users to connect and change their own expired passwords without administrative intervention, consider using a pre-logon connect method. See Remote Access VPN with Pre-Logon for details.
If users allow their passwords to expire, you may assign a temporary LDAP password to enable them to log in to the VPN. In this case, the temporary password may be used to authenticate to the portal, but the gateway login may fail because the same temporary password cannot be re-used. To prevent this, enable an authentication override in the portal configuration (
Network
GlobalProtect
Portal
) to enable the agent to use a cookie to authenticate to the portal and use the temporary password to authenticate the gateway.
Select
Device
Authentication Profile
and
Add
a new profile.
Enter a
Name
for the profile and then select
LDAP
as the authentication
Type
.
Select the LDAP authentication
Server Profile
that you created in 1 from the drop-down.
Enter
sAMAccountName
as the
Login Attribute
.
Set the
Password Expiry Warning
to specify the number of days before password expiration that users will be notified. By default, users will be notified seven days prior to password expiration (range is 1-255). Because users must change their passwords before the end of the expiration period, make sure you provide a notification period that is adequate for your user base to ensure continued access to the VPN. To use this feature, you must specify one of the following types of LDAP servers in your LDAP server profile:
active-directory
,
e-directory
, or
sun
.
Users cannot access the VPN if their passwords expire unless you enable pre-logon.
Configure an optional custom expiry message to include additional instructions, such as help desk contact information or a link to a password portal where users can change their passwords (see Customize the GlobalProtect Agent).
Specify the domain name and username format. The device combines the
User Domain
and
Username Modifier
values to modify the domain/username string that a user enters during login. The device uses the modified string for authentication and uses the
User Domain
value for User-ID group mapping. Modifying user input is useful when the authentication service requires domain/username strings in a particular format and you don’t want to rely on users to correctly enter the domain. You can select from the following options:
To send only the unmodified user input, leave the
User Domain
blank (the default) and set the
Username Modifier
to the variable
%USERINPUT%
(the default).
To prepend a domain to the user input, enter a
User Domain
and set the
Username Modifier
to
%USERDOMAIN%\%USERINPUT%
.
To append a domain to the user input, enter a
User Domain
and set the
Username Modifier
to
%USERINPUT%@%USERDOMAIN%
.
If the
Username Modifier
includes the
%USERDOMAIN%
variable, the
User Domain
value replaces any domain string that the user enters. If the
User Domain
is blank, that means the device removes any user-entered domain string.
Select the
Advanced
tab.
In the Allow List,
Add
and then select the users and groups that are allowed to authenticate with this profile. Selecting the predefined
all
option allows every user to authenticate. By default, the list has no entries, which means no users can authenticate.
Click
OK
.
Commit the configuration.
Click
Commit
.