Authentication Profile

Authentication profiles define how users authenticate to Palo Alto Networks Strata Cloud Manager, supporting LDAP, RADIUS, Kerberos, SAML, and other methods. The scm CLI provides commands to create, update, delete, and bulk manage authentication profiles.

Overview

The authentication-profile commands allow you to:

Create authentication profiles with various authentication methods
Update existing profile configurations including lockout and MFA settings
Delete profiles that are no longer needed
Bulk import profiles from YAML files
Export profiles for backup or migration

Set Authentication Profile

Create or update an authentication profile.

Syntax

scm set identity authentication-profile NAME [OPTIONS]

Arguments

Argument	Description	Required
`NAME`	Profile name	Yes

Options

Option	Description	Required
`--folder TEXT`	Folder location	No*
`--snippet TEXT`	Snippet location	No*
`--device TEXT`	Device location	No*
`--method TEXT`	Authentication method as JSON	No
`--user-domain TEXT`	User domain	No
`--username-modifier TEXT`	Username modifier pattern	No
`--lockout TEXT`	Lockout configuration as JSON	No
`--allow-list TEXT`	Allow list entries	No
`--multi-factor-auth TEXT`	Multi-factor auth configuration as JSON	No
`--single-sign-on TEXT`	SSO configuration as JSON	No

* One of --folder, --snippet, or --device is required.

Examples

Create LDAP Authentication Profile

$ scm set identity authentication-profile corp-ldap-auth \
    --folder Texas \
    --method '{"ldap": {"server_profile": "corp-ldap", "login_attribute": "sAMAccountName"}}' \
    --user-domain "example.com"
---> 100%
Created authentication-profile: corp-ldap-auth in folder Texas

Create RADIUS Authentication Profile with Lockout

$ scm set identity authentication-profile corp-radius-auth \
    --folder Texas \
    --method '{"radius": {"server_profile": "corp-radius"}}' \
    --lockout '{"failed_attempts": 5, "lockout_time": 30}'
---> 100%
Created authentication-profile: corp-radius-auth in folder Texas

Create SAML Profile with MFA

$ scm set identity authentication-profile corp-saml-mfa \
    --folder Texas \
    --method '{"saml_idp": {"server_profile": "corp-saml"}}' \
    --multi-factor-auth '{"mfa_enable": true, "factors": ["okta-otp"]}' \
    --single-sign-on '{"realm": "example.com"}'
---> 100%
Created authentication-profile: corp-saml-mfa in folder Texas

Delete Authentication Profile

Delete an authentication profile from SCM.

Syntax

scm delete identity authentication-profile NAME [OPTIONS]

Arguments

Argument	Description	Required
`NAME`	Profile name	Yes

Options

Option	Description	Required
`--folder TEXT`	Folder location	No*
`--snippet TEXT`	Snippet location	No*
`--device TEXT`	Device location	No*
`--force`	Skip confirmation prompt	No

* One of --folder, --snippet, or --device is required.

Example

$ scm delete identity authentication-profile corp-ldap-auth \
    --folder Texas \
    --force
---> 100%
Deleted authentication-profile: corp-ldap-auth from folder Texas

Load Authentication Profile

Load multiple authentication profiles from a YAML file.

Syntax

scm load identity authentication-profile [OPTIONS]

Options

Option	Description	Required
`--file TEXT`	Path to YAML file	Yes
`--folder TEXT`	Folder location override	No
`--snippet TEXT`	Snippet location override	No
`--device TEXT`	Device location override	No
`--dry-run`	Preview changes without applying	No

YAML File Format

---
authentication_profiles:
  - name: corp-ldap-auth
    folder: Texas
    method:
      ldap:
        server_profile: corp-ldap
        login_attribute: sAMAccountName
    user_domain: example.com

  - name: corp-radius-auth
    folder: Texas
    method:
      radius:
        server_profile: corp-radius
    lockout:
      failed_attempts: 5
      lockout_time: 30

Examples

Load with Original Locations

$ scm load identity authentication-profile --file auth-profiles.yml
---> 100%
✓ Loaded authentication-profile: corp-ldap-auth
✓ Loaded authentication-profile: corp-radius-auth

Successfully loaded 2 out of 2 authentication-profiles from 'auth-profiles.yml'

Load with Folder Override

$ scm load identity authentication-profile \
    --file auth-profiles.yml \
    --folder Austin
---> 100%
✓ Loaded authentication-profile: corp-ldap-auth
✓ Loaded authentication-profile: corp-radius-auth

Successfully loaded 2 out of 2 authentication-profiles from 'auth-profiles.yml'

note

When using container override options (--folder, --snippet, --device), all authentication profiles will be loaded into the specified container, ignoring the container specified in the YAML file.

Show Authentication Profile

Display authentication profile objects.

Syntax

scm show identity authentication-profile [NAME] [OPTIONS]

Arguments

Argument	Description	Required
`NAME`	Profile name; omit to list all	No

Options

Option	Description	Required
`--folder TEXT`	Folder location	No*
`--snippet TEXT`	Snippet location	No*
`--device TEXT`	Device location	No*
`--output, -o [table\|json\|yaml]`	Output format (default: table)	No
`--max-results INTEGER`	Maximum number of results to display	No

* One of --folder, --snippet, or --device is required.

note

When no NAME is specified, all items are listed by default.

Examples

Show Specific Authentication Profile

$ scm show identity authentication-profile corp-ldap-auth \
    --folder Texas
---> 100%
Authentication Profile: corp-ldap-auth
  Location: Folder 'Texas'
  Method: LDAP
  Server Profile: corp-ldap
  User Domain: example.com

List All Authentication Profiles (Default Behavior)

$ scm show identity authentication-profile --folder Texas
---> 100%
Authentication Profiles in folder 'Texas':
------------------------------------------------------------
Name: corp-ldap-auth
  Method: LDAP
  Server Profile: corp-ldap
------------------------------------------------------------
Name: corp-radius-auth
  Method: RADIUS
  Server Profile: corp-radius
------------------------------------------------------------

Backup Authentication Profiles

Backup all authentication profile objects from a specified location to a YAML file.

Syntax

scm backup identity authentication-profile [OPTIONS]

Options

Option	Description	Required
`--folder TEXT`	Folder location	No*
`--snippet TEXT`	Snippet location	No*
`--device TEXT`	Device location	No*
`--file TEXT`	Custom output filename	No

* One of --folder, --snippet, or --device is required.

Examples

Backup from Folder

$ scm backup identity authentication-profile --folder Texas
---> 100%
Successfully backed up 5 authentication-profiles to authentication_profile_folder_texas_20240115_120530.yaml

Backup with Custom Filename

$ scm backup identity authentication-profile \
    --folder Texas \
    --file texas-auth-profiles.yaml
---> 100%
Successfully backed up 5 authentication-profiles to texas-auth-profiles.yaml

Best Practices

Use Descriptive Names: Name profiles by their authentication method and purpose (e.g., corp-ldap-auth, vpn-radius-auth) for easy identification.
Configure Lockout Policies: Set failed attempt thresholds and lockout durations to protect against brute-force attacks.
Enable Multi-Factor Authentication: Add MFA factors to critical authentication profiles for enhanced security.
Backup Before Changes: Export existing profiles before making modifications to enable quick rollback if needed.
Use YAML for Bulk Operations: Manage multiple authentication profiles through YAML files to ensure consistency and repeatability.

Overview​

Set Authentication Profile​

Syntax​

Arguments​

Options​

Examples​

Create LDAP Authentication Profile​

Create RADIUS Authentication Profile with Lockout​

Create SAML Profile with MFA​

Delete Authentication Profile​

Syntax​

Arguments​

Options​

Example​

Load Authentication Profile​

Syntax​

Options​

YAML File Format​

Examples​

Load with Original Locations​

Load with Folder Override​

Show Authentication Profile​

Syntax​

Arguments​

Options​

Examples​

Show Specific Authentication Profile​

List All Authentication Profiles (Default Behavior)​

Backup Authentication Profiles​

Syntax​

Options​

Examples​

Backup from Folder​

Backup with Custom Filename​

Best Practices​

Overview

Set Authentication Profile

Syntax

Arguments

Options

Examples

Create LDAP Authentication Profile

Create RADIUS Authentication Profile with Lockout

Create SAML Profile with MFA

Delete Authentication Profile

Syntax

Arguments

Options

Example

Load Authentication Profile

Syntax

Options

YAML File Format

Examples

Load with Original Locations

Load with Folder Override

Show Authentication Profile

Syntax

Arguments

Options

Examples

Show Specific Authentication Profile

List All Authentication Profiles (Default Behavior)

Backup Authentication Profiles

Syntax

Options

Examples

Backup from Folder

Backup with Custom Filename

Best Practices