Clientless VPN Applications and Application Groups

[Digital_Forensics]

Hi Community Friends,

Strange issue with Clientless VPN Applications and Groups in the portal.

When I assign applications to a User or Group they do not show up.. only applications set to ANY user.

We have LDAP setup with Active Directory, the portal can see the groups I'm assigning inside the Global Protect Portal configuration.  Further, in the security polices, when assigning the exact same user groups to security polices and the users match just fine.

So I have groups setup via LDAP, they match inside security polices, but they don't match users inside the Global Protect Clientless VPN Application section.  I don't see any Clientless VPN logs besides authentication... nothing detailed enough to debug the group enumeration.

One caveat: We're using SAML SSO for authentication, not specifically LDAP/AD.  Its the same users however, and the users do match in the security rules.

I'm at a loss.

-PW