Identity Awarness question

[RemoteUser]

Users are assigned to the access roles, but the IA system is unable to recognize their accounts within the GRP AD groups that have permissions to access the resources.
how can i resolve this. if i do pdp monitor user Jhon123 the output it's empty

Thanks

[Chris_Atkinson]

Please share additional details about the environment including version/jumbo, adquery or identity collector etc

Have you validated the settings of the account unit, how many are configured ?

[RemoteUser]

Hi @Chris_Atkinson 
R81.20 JHF 53
identity collector.
all criteria should match the AR, the AR is configured to use AD groups

[PhoneBoy]

We need a lot more information like:

• Version/JHF of gateways/management
• How you have Identity Awareness set up (what acquisition method(s) are in use) 
• A diagram of the relevant gateways, identity sources, and how they connect to each other and the Internet

Generally, though, groups come from two places:

• The SAML Assertion (when used with Entra ID or other SAML provider)
• LDAP queries from the gateway (used with all other identity sources) 

For troubleshooting, see https://support.checkpoint.com/results/sk/sk183118 

[RemoteUser]

Hi @PhoneBoy  as i said:
 user is not known by the PDP Broker, Identity Collector, we performend a restart of the Identity collector service on the server but nothing change .

[RemoteUser]

the sk doesn't exist

[PhoneBoy]

Sorry, didn't notice that SK was internal.
In any case, you should start by troubleshooting Identity Collector: https://sc1.checkpoint.com/documents/Identity_Awareness_Clients_Admin_Guide/Content/Topics-IA-Client... 

[RemoteUser]

Myabe this one:
https://support.checkpoint.com/results/sk/sk114096

[the_rock]

If you run pdp update all command, what does it show?

Andy

[RemoteUser]

it's seemes issue related to domain controller

[RemoteUser]

pdp update all
output > update operation may take a few minutes

[the_rock]

So command did work, but not sure if it did much. Does pdp monitor user work for ANY user at all?

Andy

[RemoteUser]

take for example a user john.
qunado i do the:
pdp m u john
sometimes i get
sometimes i don't
sometimes i get an incorrect ip..

[the_rock]

What about any other user?

Andy

[RemoteUser]

it's randomic but same behavior

[the_rock]

Have you tried cprestart or reboot? Or if its a cluster,a failover?

Andy

[RemoteUser]

yes no fortune

[the_rock]

Here is what TAC gave me while ago for IA debugs, maybe give it a go and see if anything useful is there.

Andy

(•)•) Identity awareness debugs
# cd $FWDIR/log
# rm pdpd.elg.*
# echo "=debug_start=" >> $FWDIR/log/pdpd.elg
(•) To turn pdp debug on:
# adlog a d on
# pdp debug on
# pep debug on
# pdp debug set all all
(•) Replicate the issue
(•) To turn them off:
# adlog a d off
# pdp debug unset all all
# pdp debug off
# pep debug off
# pdp d reset
# pep d unset all all
Collect debug:
$FWDIR/log/pdpd.elg
# tar zcvf pdpd_debugs.tgz pdpd.elg*
# tar zcvf pepd_debugs.tgz pepd.elg*

[garrod]

Verify the AD Permission as well

https://support.checkpoint.com/results/sk/sk43874

https://support.checkpoint.com/results/sk/sk93938