show user group list - Shows custom group only

[MP18]

Under group mappings of LDAP i have so many AD groups.

But when i run below command 

show user group list

Total: 1
1* : Custom Group

IT does not show me any group names from AD?

what is the reason for that?

Also what is difference between Custom group and AD groups in LDAP?

[MP18]

I checked user id agent LDAP proxy is not checked.

[MP18]

When i expand i can see the OU for the groups.

So OU groups should show up in the CLI or not?

[Mick_Ball]

yes they should, i can see all of mine.

were these groups pushed to the firewall via a panorama template or setup directly on the firewall. 

[MP18]

These were setup directly on firewall.

Any idea what should i do next?

Thanks for your help so far.

[Mick_Ball]

i'm running out of ideas but perhaps you could go into group mapping settings and post the server profile and i will compare it with some of mine.

[MP18]

it is added

[Mick_Ball]

in your screen shot i can see you are using "group" as the object class.

this is the same as me but can you make sure you have no space or spaces after the word "group" as this also causes to display custom groups only.

also... check on AD that the any of the groups you are using have the attribute ObjectClass set to "group" 

[MP18]

no there is no space in the group before and after.

can you please tell me in more detaul what i need to check from server team?

[Mick_Ball]

Give them a couple of examples of your included group names and ask them the what the attribute “ObjectClass” is for these groups.

[Mick_Ball]

ost a screen shot of ...

show user group-mapping state all

[MP18]

senstive info

[MP18]

Can anyone answer the next step on this please?

[Remo]

Hi @MP18 

Is this a firewallcluster? If yes, how does it look like on the passive node? What PAN-OS version is the firewall running? Did you try this already: reboot? Did you notice this after a change in the group mapping settings? If yes, does it show again correctly if you remove the group again?

[MP18]

yes this is active passive PA

PA 5050

PAN  OS  8.0.9

I can not reboot this as it is crtical for the Corp.

I see same config in the passive PA

[Remo]

---

@MP18 wrote:

I can not reboot this as it is crtical for the Corp.

I see same config in the passive PA

---

The same config and also the same output?