Heartbeat Auth waiting on Central Update? Using incorrect Domain config for Access Server

Question

It looks like Heartbeat Auth is not ready yet and may be because Central is going to be updated, not sure? 
 What is happening is the client periodically delivers an auth to the XG but it fails and when you look at the access_server in debug you see the following: 
 ERROR Nov 02 11:41:58 [4136631104]: adsauth_handle_attrrequest: domain name 'testglobelinkuk' not found 
 
 I have seen this line before when auth is presented by RADIUS SSO or L2TP using AD backend and the logon is presented as "domain\username" and not "username@domain". Currently the access_server is incapable of properly working with "domain\username" and if used can cause unintended issues in the database with escape ASCII characters nor can I isolate any Jira fix for it. 
 Can this be confirmed we are expecting an update in how auth is being delivered by Central Heartbeat? 
 Emile

JanWeber · Accepted Answer

As outlined in https://community.sophos.com/products/xg-firewall/sophos-xg-beta-programs/sfos-v17-5-early-access/f/sophos-xg-17-5-early-access/108538/sync-sec-important-announcement-on-synchronized-security-features-on-xg-v17-5-early-access we are still waiting on the Sophos Endpoint release which will happen on November 12th for this to be fully functional. 
 While changing your AD to netbios will get you Synchronized UserID to work with the current Endpoint EAP, it will break other authentication mechanisms and you will need to change this again ones the new Sophos Endpoint is released. 
 So I would suggest waiting for November 12th and seeing it live in action.

Mr.Roboto · Answer

I my case it was the double authentication via CAA and heartbeat. 
 I deactivated the CAA and till now it seems to work without any trouble. 
 
 Many thanks to HeikoHund :=)

LuCar Toni · Answer

Hi, 
 
 As far as i know, the current Endpoint does not work properly. He is only sending the domain (netbios) instead of the FQDN. So XG will decline the request of User ID. 
 You can get this working, if you change your authentication server (AD) to netbios only - but this will cause new user. 
 There is a new client in central in the pipeline to fix this. It is not related to XG17.5 - Basically V17.5 perform everything correctly. Is is an Central EP issue.