NGAF SSL VPN Question

Newbie601186 Lv1Posted Oct-25-2025 01:06

Hi all!

We are using NGAF v8.0.47 platform.

Is it possible to use 'userPrincipalName' MS AD attribute somehow to authenticate user via LDAP connection (instead of sAMAccountName) ?

I've tried to change the corresponding option in our LDAP connection settings (Advanced Options - User Attribute), but, unfortunately, this doesn't work...

By solving this question, you may help 961 user(s).

Posting a reply earns you 2 coins. An accepted reply earns you 20 coins and another 10 coins for replying within 10 minutes. (Expired) What is Coin?

Enter your mobile phone number and company name for better service. Go

Humayun Ahmed Lv3Posted Oct-27-2025 13:32
  
Follow this article:
https://knowledgebase.sangfor.co ... 2articleType%22%3A1,%22articleId%22%3A%225c769cca95c24a1eb20dbbbc3dca974e%22,%22keyword%22%3A%22%22%7D
Jm Ramos Lv1Posted Oct-27-2025 14:02
  
When configuring the External Authentication Server in NGAF:


Go to:
Policy > Authentication > External Auth Server


Add LDAP Server:

Name: (e.g., your domain name)
IP: IP of your AD/LDAP server
Port: Usually 389 for LDAP
Base DN: e.g., DC=yourdomain,DC=com
Admin DN: e.g., CN=ldapadmin,CN=Users,DC=yourdomain,DC=com
Password: LDAP admin password



Customize the LDAP Filter:

By default, Sangfor may use sAMAccountName={0}.
You can change this to:
(userPrincipalName={0})


This tells NGAF to authenticate using the full UPN (e.g., user@domain.com) instead of the short username.



Test the Connection:

Use the “Test Validity” button to ensure the filter works.
Make sure the users in AD have valid userPrincipalName attributes.
Zonger Lv5Posted Dec-11-2025 04:11
  
According to the user guide for Sangfor NGAF v8.0.47, in the LDAP settings under Advanced Options the "user attribute" (User Attribute) can be selected when connecting to an MS Active Directory server.

However, the documentation does not explicitly state that using userPrincipalName (UPN) is supported and in previous versions the system's default for AD was sAMAccountName.

Additionally, other vendors LDAP based authentication modules often note that UPN is not supported or is only usable via special bind methods while sAMAccountName remains the standard for login.

Therefore, although NGAF lets you choose a "user attribute" for LDAP authentication, its unlikely that UPN is officially supported so your attempt to set userPrincipalName likely fails because NGAF expects sAMAccountName.

I Can Help:

Change

Moderator on This Board

1
148
3

Started Topics

Followers

Follow

917
183
94

Started Topics

Followers

Follow

Board Leaders