This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

STAS - not adding users to groups, all STAS users are in Open Group

lukg 4 months ago

Our STAS users are added to Open Group instead of AD group. When using user portal users are added to the correct AD group.

Any ideas why STAS users are not in the correct Group ?

Can STAS run as non administrator account ?

In STAS logs on DCs we can see the following:

ERROR [0xa74] 06/03/2024 17:21:38 : dcaserver_extract_data: Invalid group_off:-1

ERROR [0xa74] 06/03/2024 17:21:38 : dcaserver_extract_data: Invalid wrkst_name_off: -1

This thread was automatically locked due to age.

Top Replies

lukg 3 months ago in reply to Christoph Zech +2 verified

The solution is to use AD account for LDAP binding which has permissions to read property of memberof in active directory

Parents

0 apijnappels 4 months ago

could this have something to do with the behaviour of groups inside SFOS? Don't know about STAS, but it may only use the primary group. See this link for more information on groups.

Managing several Sophos firewalls both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.
Cancel
Vote Up 0 Vote Down

Cancel
0 lukg 4 months ago in reply to apijnappels

I have now Global escalation team from Sophos tech. support looking into it.
Cancel
Vote Up 0 Vote Down

Cancel
0 emmosophos 4 months ago in reply to lukg

Hello Lukg,

It seems the case created for this was 07250286

I can see it was escalated to GES on March 21, with a 2-business day SLA.

Let me know if you don't hear back from GES by the end of the day today.

Regards,

Emmanuel (EmmoSophos)

Technical Team Lead, Global Community Support
Sophos Support Videos | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.
Cancel
Vote Up 0 Vote Down

Cancel
0 Christoph Zech 3 months ago in reply to lukg

Hey lukg,

is there any further response or solution from Sophos Support?

We actually have the same problem and searching for a solution. Out STAS is creating user without linked AD Groups. If we login the user in SFOS User Portal, the groups are linked correctly.

Thanks in advance

Regards,

Christoph Zech
Cancel
Vote Up 0 Vote Down

Cancel
+1 lukg 3 months ago in reply to Christoph Zech

The solution is to use AD account for LDAP binding which has permissions to read property of memberof in active directory
Cancel
Vote Up +2 Vote Down

Cancel

Reply

+1 lukg 3 months ago in reply to Christoph Zech

The solution is to use AD account for LDAP binding which has permissions to read property of memberof in active directory
Cancel
Vote Up +2 Vote Down

Cancel

Children

0 Christoph Zech 3 months ago in reply to lukg

Thank your for your very fast response - this works in our case, too!

Many thanks, have a nice day ;)
Cancel
Vote Up 0 Vote Down

Cancel