TACACS configuration is not working - System logs error: Reason: Authentication profile not found for the user.
58623
Created On 04/15/20 19:52 PM - Last Modified 11/20/20 21:55 PM
Symptom
- When Tacacs is configured for authentication, users are not able to login.
- System log errors:
2020/04/15 08:02:39 medium auth auth-fa 0 failed authentication for user 'username'. Reason: Authentication profile
not found for the user. From: 123.45.67.89.
2020/04/15 07:33:18 medium auth auth-fa 0 failed authentication for user 'username'. Reason: Authentication profile
not found for the user. From: 123.45.67.89.
- On CLI: The test authentication command succeeds:
> test authentication authentication-profile tacacs-profile username 'username' password
Enter password :
Target vsys is not specified, user "'username' is assumed to be configured with a shared auth profile.
Do allow list check before sending out authentication request...
name 'username' is in group "all"
Authentication to TACACS+ server at '123.45.67.88' for user ''username''
Server port: 49, timeout: 3, flag: 4
Egress: 10.10.10.10
Attempting PAP authentication ...
PAP authentication request is created
PAP authentication request is sent with priv_lvl=1 user='username' remote address=10.10.10.10
Authorization request is created
Authorization request sent with priv_lvl=1 user='username' service=PaloAlto protocol=firewall remote address=10.10.10.10
Authorization succeeded
Number of VSA returned: 1
VSA[0]: PaloAlto-Admin-Role=superuser
Authentication succeeded!
Authentication succeeded for user "username"
Environment
- Any PAN-OS.
- Palo Alto Firewall.
- TACACS+ configured for authentication.
Cause
- Authentication Profile was set to "None" under Device > Setup > Management > Authentication settings
- The Authentication profile needs updating to be used for non-local admins. Only RADIUS, TACACS+, and SAML methods are supported.
Resolution
- The firewall is configured to use the authentication profile for all external administrators under Device > Setup > Management and edit the Authentication Settings.
- Select the Authentication Profile {TACACS profile} configured and commit the changes.
Additional Information
Output of: tail follow yes mp-log authd.log as follows:
debug: pan_auth_request_process(pan_auth_state_engine.c:3358): Receive request: msg type PAN_AUTH_REQ_REMOTE_INIT_AUTH,
conv id 2, body length 2416
debug: _authenticate_initial(pan_auth_state_engine.c:2383): Trying to authenticate (init auth): <profile: "", vsys: "",
policy: "", username "'username'"> ; timeout setting: 180 secs ; authd id: 6813065420023529573
debug: _get_auth_prof_detail(pan_auth_util.c:1081): admin user thru WebUI ''username''
Error: pan_auth_cache_get_admin_authprof(pan_auth_cache_adminusers.c:260): No default auth profile found for username
''username''
Error: _get_admin_authentication_profile_by_name(pan_auth_util.c:551): No admin auth prof found with the name ''username''
Error: _get_admin_authentication_profile(pan_auth_util.c:596): No auth prof/vsys is found for admin user ''username''
Error: pan_get_authprofile_n_setting(pan_auth_util.c:1156): Failed to get authentication profile for admin user thru
WebUI ''username'' failed authentication for user ''username''. Reason: Authentication profile not found for the user.
From: 123.45.67.89.
debug: _log_auth_respone(pan_auth_server.c:268): Sent PAN_AUTH_FAILURE auth response for user 'username'' (exp_in_days=-1
(-1 never; 0 within a day))(authd_id: 6813065420023529573)
Error: _authenticate_initial(pan_auth_state_engine.c:2551): Failed to get authentication profile