This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

XGS 19.5.3 Build 652 - AD Group members lost

Hello,

i am quite new to the XGS Appliance, coming from the UTM.

We still facing a lot of problems since the migration, one of that is the user authentication for SSO.

The import of the users and the ad groups worked well and most of the useres are directly placed in the correct groups on the xgs.

But there are some users which i had to manually add to the correct group and some of these (not all!?) which i put manually in the right group are disappearing again and again and fall back to "Open Group"

I can add them back to the group but a day or some hours later, the users are gone again.

What is going on here?

This thread was automatically locked due to age.

Top Replies

LuCar Toni 11 months ago +1 suggested

See User Authentication: Sophos Firewall: Backend Group Membership in Sophos Firewall Essentially if you add something manually, it will be override by the next authentication.

Parents

0 LuCar Toni 11 months ago

See User Authentication: Sophos Firewall: Backend Group Membership in Sophos Firewall

Essentially if you add something manually, it will be override by the next authentication.

__________________________________________________________________________________________________________________
Cancel
Vote Up +1 Vote Down

Cancel
0 Ingo Buyny 11 months ago in reply to LuCar Toni
ok, this is understandable.

But then why doesn't it affect all users that I have manually added to groups?
And why aren't the users pushed directly into the same AD groups that AD says they belong to?
Or, better asked, how can I configure the synchronization so that all users are added to the correct groups so that I don't have to rework it manually?
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Ingo Buyny 11 months ago in reply to LuCar Toni
ok, this is understandable.

But then why doesn't it affect all users that I have manually added to groups?
And why aren't the users pushed directly into the same AD groups that AD says they belong to?
Or, better asked, how can I configure the synchronization so that all users are added to the correct groups so that I don't have to rework it manually?
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 LuCar Toni 11 months ago in reply to Ingo Buyny

Like mentioned in my article: SFOS will do a first match principle of all groups and ask the AD Server for each login request. If a user logs in with whatever method, it will fetch the default group and backend groups.

BTW: UTM never showed the groups at all.

Check the backend memberships, sort your AD Groups properly in the group window and then the user should appear in the right groups.

__________________________________________________________________________________________________________________
Cancel
Vote Up +1 Vote Down

Cancel
0 Ingo Buyny 11 months ago in reply to LuCar Toni

Sorting the AD Groups inside the xgs group section did the trick, thank you very much
Cancel
Vote Up 0 Vote Down

Cancel
0 Ingo Buyny 11 months ago in reply to LuCar Toni

Sorry, 2 days later the problem is still unsolved.
Some users remain in "Open Group", even though i put that group at the bottom of the Group list and the user memberships are correct.

I purged the AD users but it didn't do anything visible. Shouldn't that delete the users from the xgs?
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni 11 months ago in reply to Ingo Buyny

Only if the AD User is not available in AD.
What backend users do you see for this user?

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Cancel
0 Ingo Buyny 11 months ago in reply to LuCar Toni

Sorry, could you explain what you mean?
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni 11 months ago in reply to Ingo Buyny

Please visit my Link above. There is a Screenshot about backend membership.

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Cancel
0 Ingo Buyny 11 months ago in reply to LuCar Toni

This specific user has no other memberships than Open Group
Cancel
Vote Up 0 Vote Down

Cancel