What is User-ID domain map?

What is User-ID domain map and what is its functionality?

• Palo Alto Firewalls
• Supported PAN-OS versions
• User-ID configuration
• Active Directory (AD) Servers, configured as a Domain controllers (DCs)

Definition:

1. Our firewall uses the domain map to store the fully qualified AD domain name (FQDN) and its equivalent NETBIOS domain (NETBIOS name).
2. It's used to normalize or convert the username and group names from FQDN to their corresponding NETBIOS domain name format.
3. For example, consider the domain 'paloaltonetworks.local' as the fqdn, then its equivalent netbios domain name is 'paloaltonetworks'
4. In an AD environment, a user which is a member of this domain will have its username as 'paloaltonetworks\username'.
    

Functionality:

Let us take a deeper look into how the firewall retrieves the NETBIOS domain name from DCs, populate the domain map and then, use it for conversion of FQDN to NETBIOS name. For simplicity and ease of illustration, the workflow is divided into three phases.

1. PHASE 1 - Retrieving the NETBIOS domain name
   1. Firewall sends the request for the netbiosname domain name while sending the LDAP partition query during LDAP refresh
   2. It populates the domain map and writes the entry into the dnsnetbios.map file
   3. It is fetched through 389/636 LDAP connection (not Global Catalog ports - 3268 or 3269)
   4. All Domain Controllers should have following info

Location: LDAP://CN=Partitions,CN=Configuration,DC=<DomainName>,
DC=<local|com>

ADSI Edit: Connect to "Configurations“ (ADSI - Active Directory Service Interfaces)

1. 5. Here's the LDAP partition query response from the DC to the firewall showing the target of the query - CN=Partitions,CN=Configuration,DC=test,DC=kunaldc,DC=com

FQDN - 'test.kunaldc.com'
Netbios domain name - 'test'

1. 6. To review the above logs on the PaloAlto firewall side, change the userid logging level to debug and set it to LDAP

> debug user-id on debug

> debug user-id set ldap all

2. PHASE 2 - Storing the NETBIOS domain name 
   1. The dnsnetbios.map file which contains the FQDN and it's NETBIOS domain name is stored internally in the Linux based directory structure on the firewall
   2. You can view the domain-map from the command line of the firewall using 'debug user-id dump domain-map'

1. 3. The domain map persists a device reload, even when you’ve deleted the group mapping profile for a respective domain
   4. Along with this any NETBIOS domain name once learnt on the firewall continues to persist unless explicitly removed via the cli command debug user-id clear domain-map

3. PHASE 3 - Apply the NETBIOS domain name to user groups and members of these groups 

The objective of the netbios name is to

1. 1. Convert 'fqdn\username' formats to NETBIOS domain name i.e. 'netbios\username' format
      1. Eg: Username test is a member of the active directory domain 'test.kunaldc.com'. It's FQDN name format is 'test.kunaldc.com\testuser'
      2. Once the firewall learns about the netbios name of the active directory domain then it will convert all the fqdn username format to netbios name formats 
      3. Hence the fqdn username format of 'test.kunaldc.com\testuser'  is converted to 'test\testuser'.
   2. Normalize the groups from full DN to short name format
      1. In absence of the domain maps, all AD groups are recognized in their full domain name format
      2. A group named sme_group whose full DN name format is
         'cn=sme_group, ou=tier2,ou=networking,ou=apac,ou=tac2,dc=test,dc=kunaldc.com,dc=com' is converted into 'test/sme_group'
      3. Simialrly, the user which is a member of sme_group and the AD domain 'test.kunaldc.com' is also transformed from 'test.kunaldc.com\testuser' to 'test\testuser'

Note:

1. Firewall applies the normalization on the users retrieved from ip-user mapping mechanisms (using methods such as - User-ID Agent, Agentless User-ID , Syslog, XML API etc.) as well as the users retrieved from DCs using LDAP 

2. Domain map is not synchronized between the Active and Passive firewalls in an Active-Passive HA setup. The Passive device must at some point serve as an Active device in the HA, in order to connect to the AD server to fetch the NETBIOS domain name via the LDAP partition query

For related issues with Group Mapping in a Multi Domain AD DS, please reference the following article:
How to Configure Group-Mapping in a Multi-Domain Active Directory Domain Services (AD DS) Forest