Microsoft Active Directory (AD) is a directory service that is based on the Lightweight Directory Access Protocol (LDAP). For a Palo Alto Networks firewall to query Active Directory for user authentication and group mapping information, it must be configured to communicate using the LDAP protocol. This is accomplished by creating an LDAP Server Profile that contains the connection details for the AD domain controller(s). This server profile is then referenced within an Authentication Profile, which defines the method for verifying user credentials against the AD database.

A. TACACS+: This is a protocol primarily used for centralized Authentication, Authorization, and Accounting (AAA) for network device administration, not for querying user directory services like Active Directory.

B. RADIUS: While Active Directory can be integrated with a RADIUS server (like Windows NPS), RADIUS is an AAA protocol, and LDAP is the native protocol for directly querying the AD directory.

D. SAML: This is an XML-based standard for single sign-on (SSO) and identity federation. It is used to exchange authentication data with an Identity Provider, not for direct directory queries.

1. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2: In the section "Configure an LDAP Server Profile

" the documentation states

"To enable the firewall to connect to your LDAP server (such as Microsoft Active Directory or OpenLDAP)

you must configure an LDAP server profile."

Source: Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide 10.2. Device > Server Profiles > LDAP.

2. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2: The section on "Authentication Profile Configuration" explains how different server profiles are used. It shows that an Authentication Profile of type LDAP requires an LDAP Server Profile to be selected

which facilitates the connection to a directory service like Active Directory.

Source: Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide 10.2. Device > Authentication Profile.

3. Palo Alto Networks PCNSA Study Guide: The guide explicitly details the process of integrating with directory services. In the "Configure User-ID" section

it clarifies that an LDAP server profile is required to connect the firewall to Microsoft Active Directory to retrieve user and group information.

Source: Palo Alto Networks. (2023). Palo Alto Networks Certified Network Security Administrator (PCNSA) Study Guide. Module 6: User-ID.