Set Up LDAP Authentication
LDAP is often used by organizations as a central repository for user information and as an authentication service. It can also be used to store the role information for application users.
- Create a server
profile.The server profile identifies the external authentication service and instructs the firewall how to connect to that authentication service and access the authentication credentials for your users.When you use LDAP to connect to Active Directory (AD), you must create a separate LDAP server profile for every AD domain.
- Select DeviceServer Profiles and select the LDAP profile.
- Click Add and enter a Profile Name, such as GP-User-Auth.
- If this profile is for a firewall with multiple virtual systems capability, select a virtual system or Shared as the Location where the profile is available.
- Select the Type of LDAP server.
- Click Add in the Servers section and then enter the necessary information for connecting to the authentication server, including the server Name, IP address or FQDN of the Server, and Port.
- Specify settings to enable the authentication service to authenticate the firewall. Enter the Bind DN and Password.
- If you want the device to use SSL or TLS for a more
secure connection with the directory server, select the Require
SSL/TLS secured connection check box (selected by default).
The protocol that the device uses depends on the server Port:
- 389 (default)—TLS (Specifically, the device uses the StartTLS operation, which upgrades the initial plaintext connection to TLS.)
- Any other port—The device first attempts to use TLS. If the directory server doesn’t support TLS, the device falls back to SSL.
- For additional security, select the Verify
Server Certificate for SSL sessions check box so that
the device verifies the certificate that the directory server presents
for SSL/TLS connections. To enable verification, you also have to
select the Require SSL/TLS secured connection check
box. For verification to succeed, the certificate must meet one
of the following conditions:
- It is in the list of device certificates: DeviceCertificate ManagementCertificatesDevice Certificates. Import the certificate into the device, if necessary.
- The certificate signer is in the list of trusted certificate authorities: DeviceCertificate ManagementCertificatesDefault Trusted Certificate Authorities.
- Click OK to save the server profile.
Create an authentication profile.The authentication profile specifies the server profile for the portal or gateways to use when they authenticate users. On a portal or gateway, you can assign one or more authentication profiles in one or more client authentication profiles. For descriptions of how an authentication profile within a client authentication profile supports granular user authentication, see Configure a GlobalProtect Gateway and Set Up Access to the GlobalProtect Portal.To enable users to connect and change their own expired passwords without administrative intervention, consider using a pre-logon connect method. See Remote Access VPN with Pre-Logon for details.If users allow their passwords to expire, you may assign a temporary LDAP password to enable them to log in to the VPN. In this case, the temporary password may be used to authenticate to the portal, but the gateway login may fail because the same temporary password cannot be re-used. To prevent this, enable an authentication override in the portal configuration (NetworkGlobalProtectPortal) to enable the agent to use a cookie to authenticate to the portal and use the temporary password to authenticate the gateway.
- Select DeviceAuthentication Profile and Add a new profile.
- Enter a Name for the profile and then select LDAP as the authentication Type.
- Select the LDAP authentication Server Profile that you created in 1 from the drop-down.
- Enter sAMAccountName as the Login Attribute.
- Set the Password Expiry Warning to
specify the number of days before password expiration that users
will be notified. By default, users will be notified seven days
prior to password expiration (range is 1-255). Because users must
change their passwords before the end of the expiration period,
make sure you provide a notification period that is adequate for
your user base to ensure continued access to the VPN. To use this
feature, you must specify one of the following types of LDAP servers
in your LDAP server profile: active-directory, e-directory,
or sun.Users cannot access the VPN if their passwords expire unless you enable pre-logon.
- Configure an optional custom expiry message to include additional instructions, such as help desk contact information or a link to a password portal where users can change their passwords (see Customize the GlobalProtect Agent).
- Specify the domain name and username format. The device
combines the User Domain and Username
Modifier values to modify the domain/username string
that a user enters during login. The device uses the modified string
for authentication and uses the User Domain value
for User-ID group mapping. Modifying user input is useful when the
authentication service requires domain/username strings in a particular
format and you don’t want to rely on users to correctly enter the
domain. You can select from the following options:
If the Username Modifier includes the %USERDOMAIN% variable, the User Domain value replaces any domain string that the user enters. If the User Domain is blank, that means the device removes any user-entered domain string.
- To send only the unmodified user input, leave the User Domain blank (the default) and set the Username Modifier to the variable %USERINPUT% (the default).
- To prepend a domain to the user input, enter a User Domain and set the Username Modifier to %USERDOMAIN%\%USERINPUT%.
- To append a domain to the user input, enter a User Domain and set the Username Modifier to %USERINPUT%@%USERDOMAIN%.
- Select the Advanced tab.
- In the Allow List, Add and then select the users and groups that are allowed to authenticate with this profile. Selecting the predefined all option allows every user to authenticate. By default, the list has no entries, which means no users can authenticate.
- Click OK.
- Commit the configuration.Click Commit.
Configure an Authentication Profile
Authentication Profile Device > Authentication Profile Select Device Authentication Profile or Panorama Authentication Profile to manage authentication profiles. To create a new profile, Add one ...
Set Up Kerberos Authentication
Set Up Kerberos Authentication Kerberos is a computer network authentication protocol that works on the basis of tickets to allow nodes communicating over a non-secure ...
Set Up RADIUS or TACACS+ Authentication
Set Up RADIUS or TACACS+ Authentication RADIUS is a client/server protocol and software that enables remote access servers to communicate with a central server to ...
Set Up SAML Authentication
Set Up SAML Authentication Security Assertion Markup Language (SAML) is an XML-based, open-standard data format for exchanging authentication and authorization data between parties, in particular, ...
Enable Two-Factor Authentication Using One-Time Passwords (OTPs)
Enable Two-Factor Authentication Using One-Time Passwords (OTPs) Use this workflow to configure two-factor authentication using one-time passwords (OTPs) on the portal and gateways. When a ...
Configure the Portal to Authenticate Satellites
Configure the Portal to Authenticate Satellites In order to register with the LSVPN, each satellite must establish an SSL/TLS connection with the portal. After establishing ...
Enable Two-Factor Authentication Using Certificate and Authentication Profiles
Enable Two-Factor Authentication Using Certificate and Authentication Profiles The following workflow describes how to configure GlobalProtect client authentication requiring the user to authenticate both to ...
Remote Access VPN with Two-Factor Authentication
Remote Access VPN with Two-Factor Authentication If you configure a GlobalProtect portal or gateway with an authentication profile and a certificate profile (which together can ...
Configure Captive Portal
Configure Captive Portal The following procedure shows how to set up Captive Portal authentication by configuring the PAN-OS integrated User-ID agent to redirect web requests ...