Sophos Firewall

Discussions STAS - not adding users to groups, all STAS users are in Open Group

Sophos Firewall requires membership for participation - click to join

Thread Info

State Verified Answer
+1 person also asked this people also asked this
Replies 9 replies
Answers 1 answer
Subscribers 40 subscribers
Views 1669 views
Users 0 members are here

Options

Suggested

STAS - not adding users to groups, all STAS users are in Open Group

lukg 1 month ago

Our STAS users are added to Open Group instead of AD group. When using user portal users are added to the correct AD group.

Any ideas why STAS users are not in the correct Group ?

Can STAS run as non administrator account ?

In STAS logs on DCs we can see the following:

ERROR [0xa74] 06/03/2024 17:21:38 : dcaserver_extract_data: Invalid group_off:-1

ERROR [0xa74] 06/03/2024 17:21:38 : dcaserver_extract_data: Invalid wrkst_name_off: -1

error message attached
[edited by: lukg at 6:13 PM (GMT -8) on 7 Mar 2024]

Top Replies

lukg 8 days ago in reply to Christoph Zech +2 verified

The solution is to use AD account for LDAP binding which has permissions to read property of memberof in active directory

Parents

0 LuCar Toni 1 month ago

Do you have the right servers selected under Authentication and Services? User Portal has maybe the AD server, while general authentication is not selected.

__________________________________________________________________________________________________________________
Cancel
Vote Up +1 Vote Down

Sign in to reply

Verify Answer

Reject Answer

Cancel
0 lukg 1 month ago in reply to LuCar Toni

Authentication is correctly selected and the STAS users are visible in the firewall. Groups are not assigned and we can see in the STAS logs for our users the following:

ERROR [0xa74] 06/03/2024 17:21:38 : dcaserver_extract_data: Invalid group_off:-1

ERROR [0xa74] 06/03/2024 17:21:38 : dcaserver_extract_data: Invalid wrkst_name_off: -1
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 LuCar Toni 1 month ago in reply to lukg

BTW: Primary Group is the first match group. You are aware of this? Backend Groups are the other groups, after open group.

Can you send a screenshot of one user and the order of your groups?

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Reply

0 LuCar Toni 1 month ago in reply to lukg

BTW: Primary Group is the first match group. You are aware of this? Backend Groups are the other groups, after open group.

Can you send a screenshot of one user and the order of your groups?

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Children

No Data