User ID in Expedition Does not Work

[ShawnSlater]

So it appears that UserID requires something more to apply to multiple rules.  I see conversations from 2019 posts that have no real answers.  I need to apply a UserID group pulled via LDAP across 5000 rules.  Expedition shows the full LDAP name that I added to a rule in Panorama which is fine but I can do nothing with that information.  I cannot copy, paste, edit this at all. This appears broken.  Is there an API requirement or a direct device link that needs to happen?

[azuniga]

Hello @ShawnSlater 

If I am not mistaken within the firewall you can enable userID at the zone level which should accomplish what you need done?

[ShawnSlater]

No, maybe I didn't correctly state it.  I am talking about Source User in Security Policies.  That is pulled via Group Mapping which relies on a LDAP server profile.  In Expedition it shows the full LDAP bind for the group I want.  I can do nothing with that in Expedition. I cannot change it and I cannot apply that entry to additional rules

[ShawnSlater]

When you are in Expedition and have imported Panorama configuration, under Objects there is a section for Users.  In there a Users via API and a User Groups via API.  Neither of these are actually part of a regular Panorama configuration from what I can tell.  This may be what I need but I don't know that there's anything explaining this.  

[azuniga]

Hello ShawnSlater,

Generally those UserID groups are created once you have tied the panorama device into LDAP so it can pull in those UserID groups from what you have created, I would not recommend migrating this from within expedition itself. Although yes the field does exist it would make more sense to make these changes from within Panorama to isolate East-West traffic based off of UserID.