topic Re: User format not consistent in General Topics

User format not consistent

bjhughes — Wed, 19 May 2021 20:54:28 GMT

We have a strange inconsistency with our users traffic sometimes showing in our FW logs sometimes as organizationdomain.com\username and sometimes as orgdom\username. Every now and then they also just register as no user at all.

I haven't really been able to track this one down. Has anyone had anything like this happen?

Re: User format not consistent

reaper — Thu, 20 May 2021 07:38:23 GMT

you'll want to look into normalization

the authentication profile contains a 'domain' field which should be set to the netbios name 'orgdom' (no extension)

Re: User format not consistent

Remo — Thu, 20 May 2021 11:38:41 GMT

I found this behaviour also on one of our firewalls. There is no authentication profile involved, only the integraded user agent on the firewall which queries the active directory logs.

Re: User format not consistent

reaper — Thu, 20 May 2021 11:44:15 GMT

if it's the user-id agent normalization should happen automatically, check for inconsistencies in the domain map, which is used to normalize:

debug user-id dump domain-map

if it looks odd, try clearing

debug user-id clear domain-map

refresh group mapping

debug user-id refresh group-mapping all

and wait for new users to pop up 🙂