The three valid sources for user IP address mapping in Palo Alto Networks NGFW are Client Probing, Active Directory monitoring, and eDirectory monitoring. Client Probing involves the NGFW actively querying devices to ascertain the user associated with an IP address. Active Directory monitoring allows the system to track users based on their Active Directory activities. eDirectory monitoring is similar but specifically targets environments using Novell eDirectory. These methods provide a comprehensive and dynamic approach to user identification and IP mapping critical for enforcing security policies and providing detailed audit logs.