topic Does 2 spaces cause issue with group mapping in General Topics

Does 2 spaces cause issue with group mapping

raji_toor — Tue, 30 Jul 2019 19:08:02 GMT

A securit policy is not getting used because ad group i entered is not matching the policy. On checking the cli i cannot list users in the ad group and get invalid syntax error.

show user group name cn=r-emp-it imp adm,ou=role restricted,ou=groups,ou=it ops,dc=cds,dc=abc,dc=com

Invalid syntax.

Re: Does 2 spaces cause issue with group mapping

BPry — Tue, 30 Jul 2019 20:14:27 GMT

@raji_toor,

You should be able to test that group properly if you inclose it in quotes.

show user group name 'cn=r-emp-it imp adm,ou=role restricted,ou=groups,ou=it ops,dc=cds,dc=abc,dc=com'

Re: Does 2 spaces cause issue with group mapping

raji_toor — Tue, 30 Jul 2019 22:02:20 GMT

@BPry that doesn't result in anything. I have other groups configured for which i can see the results but not for this one.

show user group name 'cn=i-r-em-all,ou=groups,ou=it,dc=cds,dc=abc,dc=com'

[1 ] cds\aar....
[2 ] cds\akas....
[3 ] cds\ala....

There is however another group which i know works in policies but that also is not showing results in cli and has a single space.

Re: Does 2 spaces cause issue with group mapping

BPry — Tue, 30 Jul 2019 22:38:41 GMT

@raji_toor,

To be more clear from my earlier response, enclosing any entry that has a space in the name is how you get around the syntax issue you were getting before. This includes what we were doing here, but also when viewing/modify/setting any other entry with a space such as the name of a security rulebase entry.

I have no idea if double spaces will break the firewall's ability to actually grab group membership; I would expect it to handle that perfectly fine, but spaces are known to muck things up across AD integration so I always avoid using them in the actual CN. It would be interesting to look at the XML configuration and verify that the <member> entry under <source-user> for this particular policy was actually propagating properly, or if double spaces is screwing up the rule creation through the GUI. You could alternatively utilize the CLI command show rulebase security rules <entry> and see if it's getting cutoff or not.

Re: Does 2 spaces cause issue with group mapping

Mick_Ball — Wed, 31 Jul 2019 08:41:56 GMT

to confirm....

show user group name 'cn=non remote helpers,ou=workstation,ou=restricted groups,ou=groups,dc=xxxx,dc=xxxx,dc=uk'

does return the expected list of users from AD.

we do have quite a few groups with multiple spaces and all work fine.