Integrating OpenLDAP

In your LDAP directory, create a service account that has admin privileges and that can run ldapsearch queries.
This admin account will be used by Prisma Cloud to authenticate users in your LDAP directory. It should be able to control the entire domain, and should therefore be created under the root OU.
Verify that the service account can query your LDAP directory.
Run ldapsearch, passing it the credentials for your service account, and query your directory for a user:
$ ldapsearch -x \
  -b dc=example,dc=com \
  -D "cn=<SA-CN>,dc=example,dc=com" \
  -w <SA-PASS>
  "(cn=<some-user-cn>)"
Where:
<SA-CN>
--
Common name for the Prisma Cloud service account.
<SA-PASS>
--
Password for the Prisma Cloud service account.
<some-user-cn>
--
Common name for a user in your LDAP directory.
Open Console, and go to
Manage > Authentication > Identity Providers > LDAP
.
Set
Integrate LDAP users and groups with Prisma Cloud
to
Enabled
.
For
Authentication type
, select
OpenLDAP
.
For
Path to LDAP service
, enter the LDAP server and port number in the following format:
For secure connections over TLS: ldaps://<server-dns>:<port-number>.
For insecure connections: ldap://<server-dns>:<port-number>
For
Search base
, enter the base DN for your users and groups.
(OPTIONAL) For
User identifier
, specify an attribute to be used to match users.
For example, enter uid to match users based on their user IDs.
For
Service account UPN
, enter the DN for your Prisma Cloud service account.
For
Service account password
, enter the password for the Prisma Cloud service account.
For
CA certificate
, provide the CA certificate used to sign the LDAPS certificate on the server.
Prisma Cloud uses the CA certificate to validate the LDAPS certificate and prevent man-in-the-middle attacks. If you are using an insecure connection or do not wish to validate the LDAPS certificate, leave this field blank.
Click
Save
.
Console verifies all your parameters with the server. If a connection cannot be established, an error message is shown and no parameters are saved.