topic Re: Command user group name not working in General Topics

Command user group name not working

BigPalo — Thu, 16 Apr 2020 13:44:32 GMT

Hi,

We just check that the command: show user group name 'cn=......' has this output:

user group xxxxx does not exist or does not have members. All config is OK.

If we run "show user group list", i can see al the groups, but filtering by one of them shows:

user group xxxxx does not exist or does not have members

show user ip-user-mapping all ---> OK

show user user-ids match-user xxxx ---> OK

Why is not showing users in groups?

Re: Command user group name not working

BPry — Thu, 16 Apr 2020 13:53:46 GMT

@BigPalo,

Is the group in your group-include-list? My first thought would be that you are trying to look at group membership for a group that the firewall isn't actively pulling, thus it doesn't know/care if anyone is in that group. Trying running the same command on something that you are actively included in your group-include-list and you should have all members listed.

Re: Command user group name not working

BigPalo — Thu, 16 Apr 2020 14:06:12 GMT

Yes, group is included in the list. We tried to put all in list, just in case, but the result is the same. Its weird...

Its happening with all the groups in "show user group list".

Re: Command user group name not working

BPry — Thu, 16 Apr 2020 14:14:05 GMT

@BigPalo,

Hmm that's really odd. I might try restarting the management plane just to see if that resolves the issue, otherwise I would open a support case about it.

Re: Command user group name not working

Mick_Ball — Thu, 16 Apr 2020 16:23:30 GMT

Probably teaching you to suck eggs here but have you copied and paste group name as syntax is essential here..

also.. do you have any special characters in the group name such as ampersand or comma...

do you get the expected output from show user group-mapping state all. Return the expected output.

do you only have permissions to see the groups but not the members.

is your group mapping correct.... ie- object for both group objects and user objects.

Re: Command user group name not working

BigPalo — Fri, 17 Apr 2020 06:24:56 GMT

Its happening for all groups using "show user group name xx" comand.

We have vsys and we also tried go in the vsys to tun the command.

The rest of the mapping commands are working fine.

About user permission, customer has more FWs with this bind ldap user and in the rest of fws are working fine this command.

Re: Command user group name not working

Bath-Spa — Tue, 16 Jun 2020 14:55:44 GMT

Did you ever figure this out as we seem to have the same issue and its affecting our VPN groups as its apparently the user isn't in the allowed auth list even though if you look at the user in the cli it will list the group but listing the group members in the cli comes up with a "user group does not exist or does not have members"

Re: Command user group name not working

TonyP — Fri, 12 Aug 2022 14:05:12 GMT

Just upgraded panos to 10.1 from 9.1 and noticed the command "user group name" does not work anymore.

On panos 9.1 had no problems with the same config. We use LDAP group mapping for the globalprotect VPN. Fortunately the upgrade didn't broke the VPN functionality, but (it seems) only the cli command.

As BigPalo already noticed, the rest of the mapping commands seems working fine.