Configure an Authentication Profile and Sequence (2024)

(

External service only

) Enable the firewallto connect to an external server for authenticating users:

Set up the external server. Refer to yourserver documentation for instructions.

Configure a server profile for the type of authenticationservice you use.

Adda RADIUS server profile.

If the firewallintegrates with an MFA service through RADIUS, you must add a RADIUSserver profile. In this case, the MFA service provides all the authenticationfactors. If the firewall integrates with an MFA service througha vendor API, you can still use a RADIUS server profile for thefirst factor but MFA server profiles are required for additionalfactors.

Addan MFA server profile.

Adda SAML IdP server profile.

Adda Kerberos server profile.

Adda TACACS+ server profile.

Addan LDAP server profile.

(

See Also

Use the Administrator Login Activity Indicators to Detect Account Misuse

Local database authentication only

) Configurea user database that is local to the firewall.

Perform these steps for each user and user group for whichyou want to configure LocalAuthentication based on a user identity store that is localto the firewall:

Addthe user account to the local database.

(

Optional

) Addthe user group to the local database.

(

Kerberos SSO only

) Create a Kerberos keytabfor the firewall if Kerberos single sign-on (SSO) is the primaryauthentication service.

Createa Kerberos keytab. A keytab is a file that contains Kerberosaccount information for the firewall. To support Kerberos SSO, yournetwork must have a Kerberos infrastructure.

Configure anauthentication profile.

Define one or both of the following:

KerberosSSO

—The firewall first tries SSO authentication. If that fails,it falls back to the specified authentication

Type

.

External authentication or local database authentication

—Thefirewall prompts the user to enter login credentials, and uses anexternal service or local database to authenticate the user.

Select

Device

Authentication Profile

and

Add

theauthentication profile.

Enter a

Name

to identify theauthentication profile.

Select the

Type

of authenticationservice.

If you use Multi-FactorAuthentication, the selected type applies only to the firstauthentication factor. You select services for additional MFA factorsin the

Factors

tab.

If you select

RADIUS

,

TACACS+

,

LDAP

,or

Kerberos

, select the

ServerProfile

.

If you select

LDAP

,select the

Server Profile

and define the

LoginAttribute

. For Active Directory, enter

sAMAccountName

asthe value.

If you select

SAML

, selectthe

IdP Server Profile

.

If you want to enable Kerberos SSO, enter the

KerberosRealm

(usually the DNS domain of the users, except thatthe realm is UPPERCASE) and

Import

the

KerberosKeytab

that you created for the firewall or Panorama.

(

MFA only

) Select

Factors

,

EnableAdditional Authentication Factors

, and

Add

theMFA server profiles you configured.

The firewall will invoke each MFA service in the listedorder, from top to bottom.

Select

Advanced

and

Add

theusers and groups that can authenticate with this profile.

You can select users and groups from the local databaseor, if you configured the firewall to MapUsers to Groups, from an LDAP-based directory service suchas Active Directory. By default, the list is empty, meaning no userscan authenticate.

You can also select customgroups defined in a group mapping configuration.

(

Optional

) To modify the user informationbefore the firewall sends the authentication request to the server,configure a

Username Modifier

.

%USERDOMAIN%\%USERINPUT%

—Ifthe source does not include the domain (for example, it uses thesAMAccountName), the firewall adds the

User Domain

youspecify before the username. If the source includes the domain,the firewall replaces that domain with the

User Domain

.If the

User Domain

is empty, the firewallremoves the domain from the user information that the firewall receivesfrom source before the firewall sends the request to the authenticationserver.

Because LDAP servers do not support backslashes inthe sAMAccountName, do not use this option to authenticate withan LDAP server.

%USERINPUT%

—(Default) The firewall sendsthe user information to the authentication server in the formatit receives from the source.

%USERINPUT%@%USERDOMAIN%

—If the sourcedoes not include the domain, the firewall adds the

UserDomain

value after the username. If the source includesdomain, the firewall replaces that domain with the

UserDomain

value. If the

User Domain

isempty, the firewall removes the domain from the user information thatthe firewall receives from the source before the firewall sendsthe request to the authentication server.

None

—If you manually enter

None

:

For LDAP and Kerberos server profiles, the firewall usesthe domain it receives from the source to select the appropriateauthentication profile, then removes the domain when it sends theauthentication request to the server. This allows you to includethe

User Domain

during the authenticationsequence but remove the domain before the firewall sends the authenticationrequest to the server. For example, if you are using an LDAP serverprofile and the samAccountName as the attribute, use this optionso that the firewall does not send the domain to the authenticationserver that expects only a username and not a domain.

For RADIUS server profiles:

If the source sendsthe user information in

domain\username

format,the firewall sends the user information to the server in the sameformat.

If the source sends the user information in

username@domain

format,the firewall normalizes the user information to the

domain\username

formatbefore sending it to the server.

If the source sends only the username, the firewall addsthe

User Domain

you specify before sendingthe information to the server in

domain\username

format.

For local databases, TACACS+, and SAML, the firewall sendsthe user information to the authentication server in the formatit receives from the source.

Click

OK

to save the authenticationprofile.

Configure an authentication sequence.

Required if you want the firewall to try multiple authenticationprofiles to authenticate users. The firewall evaluates the profilesin top-to-bottom order until one profile successfully authenticatesthe user.

Select

Device

Authentication Sequence

and

Add

theauthentication sequence.

Enter a

Name

to identify theauthentication sequence.

To expedite the authenticationprocess,

Use domain to determine authentication profile

:the firewall matches the domain name that a user enters during login withthe

User Domain

or

Kerberos Realm

ofan authentication profile in the sequence, and then uses that profileto authenticate the user. If the firewall does not find a match,or if you disable the option, the firewall tries the profiles inthe top-to-bottom sequence.

Add

each authentication profile.To change the evaluation order of the profiles, select a profileand

Move Up

or

Move Down

.

Click

OK

to save the authenticationsequence.

Assign the authentication profile or sequence to an administrativeaccount for firewall administrators or to Authentication policyfor end users.

Administrators

—Assign the authentication profilebased on how you manager administrator authorization:

Authorizationmanaged locally on the firewall—Configurea Firewall Administrator Account.

Authorization managedon a SAML, TACACS+, or RADIUS server—Select

Device

Setup

Management

,edit the Authentication Settings, and select the

AuthenticationProfile

.

End users

—For thefull procedure to configure authentication for end users, see ConfigureAuthentication Policy.

Verify that the firewall can TestAuthentication Server Connectivity to authenticate users.

{{ } else { }}