Add domain user account as administrator.

In the XG firewall you can add allow the administrative access to a security groups in AD, its different from what you have seen in the UTM appliances.Initially when you integrate the firewall with the Active directory and Import the groups XG firewall only imports the Groups and not the users inside the group.

The bottom line is Active Directory Users can login to the XG firewall using their domain account but there was a couple of steps added to this. If an user xyz@domain.com would like to manage the appliance, there were 2 additional steps added before we can achieve this 

Step 1 involves the System>Authentication>Authentication Services Make sure the Active directory server that was added earlier is selected under Administrator Authentication Methods and Firewall Authentication Methods 

Step 2 The admin user from AD have to login to the user-portal @ https://ipofXGfirewall if he is connecting from WAN or simply login to the captive-portal if the admin user is behind the firewall. The intention behind this behind the firewall will auto create the user account for the admin users. 

Step 3: The super admin user have to approve all the admin users from the Active Directory Manually this can be done under objects > identity > users (This is just for additional security reasons) attaching a screen shot below for your reference. 

Ok I have checked and when using a domain user to authenticate to the portal at https://ipofXGfirewall, I see successful authentication events on the DC's. (As well as failed auth events when I purposefully put in an invalid password.)

However, I continue to receive "Login Failed" on the portal and no user is automatically created in XG users.

To recap, course of events:
1. DC is added as auth server. Test option performed and successful.
2. Import of groups.
3. Set auth services to use DC as first in list. and group to one of the groups imported. (user is member, for test I even tried Domain Users.)
4. Sign in to https://ipofxgfirewall
5. receive "Login Failed".
6. Logs in XG show failed because of wrong credentials.
7. Confirmed in domain controller that the security event was a successful authentication attempt.
Also confirmed a failed attempt reports correctly.

So at this point while I see the auth attempts making it to the DC and being validated as a success, the XG is failing and not creating the user. (I assume the login failed is simply because the user does not exists locally in the XG's user list at this point.)

I will do some additional testing this weekend, but I would also like to submit an enhancement request.

Story: As a firewall administrator, I would like the ability to create a domain user in the users list manually, so that the user may be staged as an admin and authenticate as such.

Thanks.

EDIT:

Noticed these in the access_server.log:

ERROR Nov 13 22:21:12 [4135582528]: adsauth_authenticate_user: '10.100.1.11:636':(filter: '(sAMAccountName=jonathan)') USER not found
ERROR Nov 13 22:21:12 [4141873984]: pg_db_handle_authenticate_user: No rows found
ERROR Nov 13 22:21:12 [4144678656]: check_auth_result: VPN/SSLVPN/MYACC Authentication Failed

I'm not sure of your error structure, but to line this up with the successful DC event:

A logon was attempted using explicit credentials.

Subject:
Security ID: SYSTEM
Account Name: <masked>
Account Domain: <masked>
Logon ID: 0x3E7
Logon GUID: {00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
Account Name: jonathan
Account Domain: <masked>
Logon GUID: {00000000-0000-0000-0000-000000000000}

Target Server:
Target Server Name: localhost
Additional Information: localhost

Process Information:
Process ID: 0x204
Process Name: C:\Windows\System32\lsass.exe

Network Information:
Network Address: 10.100.1.254
Port: 59856

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.

Ok I have checked and when using a domain user to authenticate to the portal at https://ipofXGfirewall, I see successful authentication events on the DC's. (As well as failed auth events when I purposefully put in an invalid password.)

However, I continue to receive "Login Failed" on the portal and no user is automatically created in XG users.

To recap, course of events:
1. DC is added as auth server. Test option performed and successful.
2. Import of groups.
3. Set auth services to use DC as first in list. and group to one of the groups imported. (user is member, for test I even tried Domain Users.)
4. Sign in to https://ipofxgfirewall
5. receive "Login Failed".
6. Logs in XG show failed because of wrong credentials.
7. Confirmed in domain controller that the security event was a successful authentication attempt.
Also confirmed a failed attempt reports correctly.

So at this point while I see the auth attempts making it to the DC and being validated as a success, the XG is failing and not creating the user. (I assume the login failed is simply because the user does not exists locally in the XG's user list at this point.)

I will do some additional testing this weekend, but I would also like to submit an enhancement request.

Story: As a firewall administrator, I would like the ability to create a domain user in the users list manually, so that the user may be staged as an admin and authenticate as such.

Thanks.

EDIT:

Noticed these in the access_server.log:

ERROR Nov 13 22:21:12 [4135582528]: adsauth_authenticate_user: '10.100.1.11:636':(filter: '(sAMAccountName=jonathan)') USER not found
ERROR Nov 13 22:21:12 [4141873984]: pg_db_handle_authenticate_user: No rows found
ERROR Nov 13 22:21:12 [4144678656]: check_auth_result: VPN/SSLVPN/MYACC Authentication Failed

I'm not sure of your error structure, but to line this up with the successful DC event:

A logon was attempted using explicit credentials.

Subject:
Security ID: SYSTEM
Account Name: <masked>
Account Domain: <masked>
Logon ID: 0x3E7
Logon GUID: {00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
Account Name: jonathan
Account Domain: <masked>
Logon GUID: {00000000-0000-0000-0000-000000000000}

Target Server:
Target Server Name: localhost
Additional Information: localhost

Process Information:
Process ID: 0x204
Process Name: C:\Windows\System32\lsass.exe

Network Information:
Network Address: 10.100.1.254
Port: 59856

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.