topic Re: show user group list - Shows custom group only in General Topics

show user group list - Shows custom group only

MP18 — Wed, 03 Apr 2019 04:00:09 GMT

Under group mappings of LDAP i have so many AD groups.

But when i run below command

show user group list

Total: 1
1* : Custom Group

IT does not show me any group names from AD?

what is the reason for that?

Also what is difference between Custom group and AD groups in LDAP?

Re: show user group list - Shows custom group only

Mick_Ball — Wed, 03 Apr 2019 13:15:59 GMT

do you have the correct setting in device/user identification/group mapping settings/server profile/group objects/object class

this needs to set to group. if set to user it will not show in cli

AD groups are all users with the group attribute of "member"

custom groups are defined from an attribute of your choice, in affect... a custom group...

Re: show user group list - Shows custom group only

MP18 — Wed, 03 Apr 2019 13:54:44 GMT

I have same settings as you have shown

Re: show user group list - Shows custom group only

Mick_Ball — Wed, 03 Apr 2019 14:10:55 GMT

and are your groups listed in "included groups" as below

Re: show user group list - Shows custom group only

MP18 — Wed, 03 Apr 2019 14:12:56 GMT

yes i have as you mentioned.

Re: show user group list - Shows custom group only

Mick_Ball — Wed, 03 Apr 2019 14:29:14 GMT

try...

show user group-mapping state all

can you see a line with "proxy state"

if you can then go to user-id agents and remove "use as ldap proxy"

Re: show user group list - Shows custom group only

MP18 — Wed, 03 Apr 2019 15:06:52 GMT

no i do not see line with proxy state

Re: show user group list - Shows custom group only

Mick_Ball — Wed, 03 Apr 2019 15:10:00 GMT

are you running multi VSYS?

Re: show user group list - Shows custom group only

MP18 — Wed, 03 Apr 2019 15:16:45 GMT

Not running multivsys

Re: show user group list - Shows custom group only

Mick_Ball — Wed, 03 Apr 2019 15:33:50 GMT

show user group-mapping statistics

how many groups are numbered here?

do you use policies based on group mappings and do they work?

Re: show user group list - Shows custom group only

Mick_Ball — Wed, 03 Apr 2019 15:35:55 GMT

also can you post a screen shot of the group include section.

Re: show user group list - Shows custom group only

MP18 — Wed, 03 Apr 2019 15:48:01 GMT

show user group-mapping statistics

Name Vsys Groups Last-Action(secs) Next-Action(secs)
---------------------------------------------------------------------------
Group_Mapping_1 vsys1 11 2587 secs ago(took 0 secs) In 1013 secs
Group_Mapping_2 vsys1 8 2590 secs ago(took 0 secs) In 1010 secs

yes i use group mapping in policies and they work

Re: show user group list - Shows custom group only

MP18 — Wed, 03 Apr 2019 15:54:30 GMT

Added

Re: show user group list - Shows custom group only

Mick_Ball — Wed, 03 Apr 2019 16:23:10 GMT

in your screen shot i cannot see the OU for any of the groups.

could you find one of the groups in the available list and make sure it has no special characters in the OU. as below.

if my OU was called developer&objects it would not show in CLI.

Re: show user group list - Shows custom group only

Mick_Ball — Wed, 03 Apr 2019 16:24:42 GMT

and i may have mentioned this before but just check your user ID agent settings and make sure none of them have a tick in "use as LDAP proxy".

Re: show user group list - Shows custom group only

MP18 — Wed, 03 Apr 2019 17:35:47 GMT

I checked user id agent LDAP proxy is not checked.

Re: show user group list - Shows custom group only

MP18 — Wed, 03 Apr 2019 17:36:51 GMT

When i expand i can see the OU for the groups.

So OU groups should show up in the CLI or not?

Re: show user group list - Shows custom group only

Mick_Ball — Thu, 04 Apr 2019 11:10:18 GMT

yes they should, i can see all of mine.

were these groups pushed to the firewall via a panorama template or setup directly on the firewall.

Re: show user group list - Shows custom group only

MP18 — Fri, 05 Apr 2019 04:11:04 GMT

These were setup directly on firewall.

Any idea what should i do next?

Thanks for your help so far.

Re: show user group list - Shows custom group only

Mick_Ball — Fri, 05 Apr 2019 07:25:37 GMT

i'm running out of ideas but perhaps you could go into group mapping settings and post the server profile and i will compare it with some of mine.