This credential detection method checks for valid username submissions. You can use this method to detect credential submissions that include a valid corporate username (regardless of the accompanying password). The firewall determines a username match by verifying that the username matches the user logged in the source IP address of the session. To use this method, the firewall matches the submitted username against its IP-address-to-username mapping table. To use this method you can use any of the user mapping methods described in Map IP Addresses to Users.

The firewall determines if the username a user submits to a restricted site matches any valid corporate username. To do this, the firewall matches the submitted username to the list of usernames in its user-to-group mapping table to detect when users submit a corporate usernames to a site in a restricted category.

This method only checks for corporate username submissions based on LDAP group membership, which makes it simple to configure, but more prone to false positives. You must enable group mapping to use this method.

This credential detection method enables the firewall to check for a valid corporate username and the associated password. The firewall determines if the username and password a user submits matches the same user’s corporate username and password.

To do this, the firewall matches credential submissions against a bloom filter of valid corporate usernames and their associated password hashes, and verifies that the submitted username maps to the IP address of the logged-in user. This mode requires a Windows-based User-ID agent installed on a read-only domain controller (RODC) and equipped with the User-ID Credential Service Add-on.

Starting with PAN-OS 12.2, you can connect multiple credential agents to a single firewall — one agent per domain or forest — to protect users across multi-domain and multi-forest Active Directory environments. Each agent contributes a separate bloom filter to the firewall's virtual system. You must install each agent on a separate RODC connected to its respective domain controller.

The credential agent also sends a username-only bloom filter that the firewall uses to identify which users have no password hash collected. You can use this to find gaps in your credential phishing coverage — for example, users whose accounts are not included in the Allowed RODC Password Replication Group on any connected RODC.

To use this method, you must also enable User-ID to map IP addresses to users using any of the supported user mapping methods, including Authentication Policy, Authentication Portal, and GlobalProtect™. See Prevent Credential Phishing for configuration details.