problem with group membership display in PAOS 5.0

[ZongguoWei]

I use the command :"show user group name domain \domain users" , the response from the firewall is :"User group 'domain\domain users' does not exist or does not have members" .

The domain users is the default group for the new user, I think maybe some error for the group membership display in the PA firewall. The PAOS version I used is the 5.0.8

[ZongguoWei]

I also try to use "show user group name "cn=domain users,cn=users,dc=xxx,dc=local", The same error prompt :User group 'cn=domain users,cn=users,dc=xxx,dc=local' does not exist or does not have members. I am sure some users are included in this group.

[kadak]

Hello ZongguoWei,

If you don't have many user-groups, could you please provide me the output for

> show user group list

> show user group-mapping state all

Thanks and regards,
Kunal Adak

[apasupulati]

Hello,

Please follow this document and ensure the device is correctly configured to pull groups from the Ldap server.

How to Configure Group Mapping settings?

CLI commands to check the groups retrieved and connection to the LDAP server:

> show user group-mapping state all  //shows the connection to ldap server and must show the 'domain users' group retrieved.

Thanks,

Aditi

[ZongguoWei]

Hi, The follow message:

show user group list

cn=administrators,cn=builtin,dc=xxx,dc=local

cn=domain admins,cn=users,dc=xxx,dc=local

cn=users,cn=builtin,dc=xxx,dc=local

cn=webaccess,ou=slls- user groups,dc=xxx,dc=local

cn=fullinternetaccess,ou=xxx- user groups,dc=xxx,dc=local

cn=domain users,cn=users,dc=xxx,dc=local

cn=guests,cn=builtin,dc=xxx,dc=local

cn=domain guests,cn=users,dc=xxx,dc=local

cn=dnsadmins,cn=users,dc=xxx,dc=local

I have marked the real domail information and replaced with xxx.

Also：

show user group-mapping state all

Group Mapping(vsys1, type: active-directory): xxx

        Bind DN    : xxx@xxx.LOCAL

        Base       : DC=xxx,DC=LOCAL

        Group Filter: (None)

        User Filter: (None)

        Servers    : configured 2 servers

                10.227.1.1(389)

                        Last Action Time: 29 secs ago(took 0 secs)

                        Next Action Time: In 31 secs

                10.227.1.2(389)

        Number of Groups: 7

        cn=users,cn=builtin,dc=xxx,dc=local

        cn=guests,cn=builtin,dc=xxx,dc=local

        cn=domain users,cn=users,dc=xxx,dc=local

        cn=domain admins,cn=users,dc=xxx,dc=local

        cn=domain guests,cn=users,dc=xxx,dc=local

        cn=dnsadmins,cn=users,dc=xxx,dc=local

        cn=administrators,cn=builtin,dc=xxx,dc=local

I want to know what's the action when I use the command :"debug user-id refresh/reset group-mapping all " ?