Palo Alto Networks – LDAP and Group Mapping config guide
In order to configure your Palo Alto Networks firewall to do filtering based on Active Directory (LDAP) user groups, you have to configured the firewall to poll your domain controllers for group membership information. The User-ID agents only identify the user names of your users, but in order to sort them into groups, you have to configure Group Mapping. (more…)