topic Re: User group Mapping in General Topics

User group Mapping

zamiedu — Thu, 12 Nov 2020 12:39:25 GMT

Wndows logon user name is ABC\xyz, and the user id fetched from AD group is ABC.local\xyz, and because of that the traffic is not hitting the configured rule. Any workaround to fix this?

Re: User group Mapping

S.Cantwell — Thu, 12 Nov 2020 16:46:29 GMT

Hello

Because the UserID FETCHED this information, it is coming from the AD server, and not created/caused by the FW.

Could you change the policy to match what is being received by the AD server?

That is the suggestion.

Are you using the built in UserID agent or the standalone (or both?)

Thanks

Re: User group Mapping

aleksandar.astardzhiev — Fri, 13 Nov 2020 20:32:16 GMT

Hi @zamiedu ,

You can override the domain detected by the group mapping. Under the group mapping profile define "user domain" to match what you have for the ip-user-mapping:

Re: User group Mapping

Abdul_Razaq — Mon, 16 Nov 2020 06:24:34 GMT

Hi @zamiedu

Usually, the domain normalization is done to normalize the domain name to NetBIOS name.

If you don't have a user domain explicitly mentioned in the authentication profile or group mapping, you can add the NetBIOS name manually as a workaround.