Add user to an additional user group

Question

Maybe I am just blind, but how is it possible with the API to assign users to another group or is it even possible to have users in several groups if they do not come from the AD?

I know that you can pass the group to the user object and by changing it, the user is assigned to this group as the main group.
But when I get the UserGroup object via the API, I have all the user groups and their settings on the one hand, and lists with all the users on the other, but I can't see which group the users now belong to. These lists are not linked to the group details.

And I also don't have the option of assigning a user to another group via the web interface. This only seems to work if the group(s) come from the AD. Is that really the case? It must be possible for the user to have several group memberships even with local administration (via API), which I can then continue to use in other places.

AlanT · Answer

Hi KaiDietrich 
 Some description of your use case would be helpful to answer more precisely, but there are some general points I can share. 
 SFOS only allows users to be in one primary group within the firewall config. If you are using AD for user authentication, though, then the primary group set in SFOS may not matter. In most cases, the firewall checks the user group membership in AD before making enforcement decisions. It doesn't support nested group memberships, but if a user is a member of groups A, B, and C in AD, and firewall rule 1 is set to match on users in group A (assuming all other match criteria are met) then the users session traffic will be handled by rule 1. 
 If rule the first web filtering rule in the policy that matches their web traffic applies only to members of group B, then that web filtering rule will be applied. If the user later connects to the firewall by ssl vpn, and there are individual vpn policies created for groups A, B, C, and D, and one created specifically linked to their username, then all of the matching VPN policies will be applied to their connection, and only the policy for group D users will not be ncluded. I hope that's clearer. Back to your API question, if after understanding the above, you still need to change a users primary group on the firewall via API, it can be done in broad description by: 1) get the user object 2) change the Group name to the desired group name 3) send the updated xml payload back as an update 
 See this link for specific details on the API parameters for user objects. Full API documentation link: API Documentation