FSSO Collector Agent issue

[syu]

Check the reply below for proper steps.

First, I did not find any section just for FSSO or Authentication, so I posted it here. Move it as needed.

I ran into some issue with Fortigate with FSSO Collector Agent. The setup is:

• Two Windows 2012 AD servers for one domain.
• No DC Agent
• FSSO Agent is installed on one of the windows 2012 member server for polling both ADs and advanced access mode.
• Fortigate is configured LDAP servers for the AD servers
• Fortigate is configured with two Single Sign-On for two user groups from the same domain (e.g. SSO 1: Domain Users; SSO 2: Polit Users)
• Fortigate is configured with two firewall user groups for the two SSO (Group 1: Domain-User-Group; Group 2: Polit-User-Group)

When check the FSSO logons via User & Devices->Monitor->Firewall, I can only see the logons for Group 1. Even I logoff/logon manually with an account from the Polit-User-Group, there is still nothing showing on Firewall.

Anything I am missing OR I should check?

[syu]

From what I tested so far, if the two group doesnot have shared users, then the user logon info will be shown on firewall with individual group; but if the user belongs to both user groups, then the firewall only shows the user logon info for the group has more users...

Can anyone confirm this is the expected result?

[syu]

Here are the proper steps:

Create LDAP Connection to AD

Create SSO Entry via FSSO for the interesting AD groups (all the groups you would want)

Create User Group on Firewall to utilize the specific AD group via the single FSSO