Trusted domains - we proxy AD SSO not pulling through group

Hi Chris and welcome to the UTM Community!

This is almost certainly in the trust relationship.  What does someone else see in comparing the two situations?

Are you running both sets of UTMs in Transparent or Standard mode?  If Standard, please show us the PAC files used in both locations.  If you prefer, obfuscate IPs like 84.XX.YY.121, 10.X.Y.100, 192.168.X.200 and 172.2X.Y.51.  That lets us see immediately which IPs are local and which are identical or just in the same subnet.

Cheers - Bob

Hi Bob,
Thanks for your reply, sorry for the delay, I was on leave.
So when you say "in the trust relationship", what specifically in that do you mean?
I can elaborate a bit further on our setup.
So we are actually 3 orgs merging, so have 3 seperate legacy forests/domains.
We have a 4th "new" forest/domain. There are 2 way cross forest trusts between the 4th new forest and the 3 legacy ones.
All setup and configured the same.
We've migrated (staged) all our users into the 4th domain, utilising sIDHistory for both users and groups.
A user in logs on to their new account in the 4th domain and tries to access web resources via the UTM proxy - their original/same UTM they would have used on legacy domain.
This is where we hit the issue - so the proxy live logs see the user and the domain, but no group.
If they switch back to their legacy account it works fine.
This same concept works if another user logs on to their new account and uses their original UTM for proxy (so this is the other HA pair I'm referring to in a different source domain).
In the live logs in this scenario I can see user, group and domain.
The UTM pair in question that does not behave as expected, is quite old now, like version 9.700-5 (which I think is RTM of 9.7?)
The UTM pair that does work is newer, 9.705-3 (and I have tried on a 9.706-9 and that also works).
So that did lead me to suspect the version is too old, but then again I had the logs showing it previously worked so that is confusing.
This is what makes me think I'm missing something simple.

In terms of the other questions, we don't use PAC files (yet) so it is direct to proxy via Internet Settings.
And both UTMs are indeed in Standard mode.
Thanks
Chris

Hi Bob,
Thanks for your reply, sorry for the delay, I was on leave.
So when you say "in the trust relationship", what specifically in that do you mean?
I can elaborate a bit further on our setup.
So we are actually 3 orgs merging, so have 3 seperate legacy forests/domains.
We have a 4th "new" forest/domain. There are 2 way cross forest trusts between the 4th new forest and the 3 legacy ones.
All setup and configured the same.
We've migrated (staged) all our users into the 4th domain, utilising sIDHistory for both users and groups.
A user in logs on to their new account in the 4th domain and tries to access web resources via the UTM proxy - their original/same UTM they would have used on legacy domain.
This is where we hit the issue - so the proxy live logs see the user and the domain, but no group.
If they switch back to their legacy account it works fine.
This same concept works if another user logs on to their new account and uses their original UTM for proxy (so this is the other HA pair I'm referring to in a different source domain).
In the live logs in this scenario I can see user, group and domain.
The UTM pair in question that does not behave as expected, is quite old now, like version 9.700-5 (which I think is RTM of 9.7?)
The UTM pair that does work is newer, 9.705-3 (and I have tried on a 9.706-9 and that also works).
So that did lead me to suspect the version is too old, but then again I had the logs showing it previously worked so that is confusing.
This is what makes me think I'm missing something simple.

In terms of the other questions, we don't use PAC files (yet) so it is direct to proxy via Internet Settings.
And both UTMs are indeed in Standard mode.
Thanks
Chris

Definitely Up2Date the pair on 9.700 before re-examining the trust relationships.

We've had no problems with 9.707 on our AWS instance since Up2Dating it last Wednesday.  9.705 is the oldest I recommend today.  9.700 is 20 months old.  9.706 & 9.707 are especially recommended for sites using the SMTP Proxy.

Cheers - Bob