topic Re: Is there a way to have Remote Access Auth via LDAP use the principle name? in SASE and Remote Access

Is there a way to have Remote Access Auth via LDAP use the principle name?

Chris_Hoff — Mon, 19 Feb 2018 16:00:42 GMT

I have my Remote Access setup to use LDAP (AD) for authentication. I am migrating from RADIUS Authentication because I would like to use the LDAP Groups in order to create different levels of access (RADIUS does not seem to push Group membership for use in rules).

Here is my issue: when using LDAP, the users need to login using the sAMAccountName (e.g. user = jdoe), but we would prefer to use a login of the userPrincipleName (e.g. user = john.doe@company.com). The reason for this is most, if not all, of the places we have login information, we use the userPrincipleName - mostly for cloud based services. All of our documentation is already set to use this as the login, and we would like to continue to use this.

Is there a way to force a Remote Access Authentication via LDAP to use the userPrincipleName instead of the sAMAccountName?

Re: Is there a way to have Remote Access Auth via LDAP use the principle name?

PhoneBoy — Mon, 14 Dec 2020 02:50:30 GMT

I'm surprised there isn't an SK on this subject, but it appears to be mentioned in a couple of recent SRs.
The correct procedure seems to be:

Ensure SmartConsole is not running
Use GUIdbedit (yes, this works even in R80.10) and find your gateway object.
Look for the field "UserLoginAttr" and make a note of the current value.
Change the value to "userPrincipalName"
Save changes and push policy.

If this doesn't work, I recommend engaging the TAC, who is probably more educated on the subject than I am.
Contact Support | Check Point Software

Edit: Formatting, Typos

Re: Is there a way to have Remote Access Auth via LDAP use the principle name?

Chris_Hoff — Tue, 20 Feb 2018 14:36:58 GMT

Thanks so much Dameon - this seems to have worked!

Re: Is there a way to have Remote Access Auth via LDAP use the principle name?

Oliver_Fink — Wed, 09 Dec 2020 10:02:51 GMT

For me "userPrincipleName" did not work, but "userPrincipalName" did. Thank you for the information, anyway. It led me to the right way.

Re: Is there a way to have Remote Access Auth via LDAP use the principle name?

PhoneBoy — Mon, 14 Dec 2020 02:51:07 GMT

Had it typo in my original answer, I'm pretty sure.
Updated my original post.