AD Sync not working reliably

[localhost]

Hi

We're trying to control the token method and user group assignment by using the active directory only.

We have two Active Directory groups named VPN-Company1 and SSO-EMAIL. One for the company which is trying to connect and another group to control if the token is send via email or sms.

We created two LDAP sync rules with following LDAP Filters:

VPN_SMS: (&(objectcategory=user)(memberof=CN=VPN-Company1,OU=Users,OU=Contoso,DC=contoso,DC=local)([style="background-color: #ffff00;"]))

VPN_EMAIL: (&(objectcategory=user)(memberof=CN=VPN-Company1,OU=Users,OU=Contoso,DC=contoso,DC=local)(memberof=CN=SSO-EMAIL,OU=Users,OU=Contoso,DC=contoso,DC=local))

Both rules will associate the user with the same Remote LDAP Group (VPN_Company1)

This works pretty well for the initial import. Problems start to occur, when we try to make changes to group members. (eg. remove users from the SSO-EMAIL group). I'd say 2 of 10 times this fails. Automatic sync seems to work better than manually syncing, but still breaks occasionally.

There are no errors in the logfile. Just the standard notification: "Successfully synced remote LDAP users.."

If the sync does not accept the changes. We have to delete the user from the FortiAuthenticator. Otherwise it will ignore any later AD group membership change for that specific user.

Is this a know issue? Or is there anything wrong with this method?

I uploaded a video which shows the issue: https://dl.dropboxusercontent.com/u/69839228/AD-Sync%20Issue.avi

Brgds

Sander

[Carl_Windsor_FTNT]

I couldn't open that video but in general this should work in most cases and works on my local test rig.  There are however some safety checks to prevent users being accidentally deleted in bulk due to group changes so you may be hitting this protection.

I recommend you open a support ticket with screenshots and configs so we can check if this is the case.

[localhost]

Carl Windsor wrote:

I couldn't open that video but in general this should work in most cases and works on my local test rig.  There are however some safety checks to prevent users being accidentally deleted in bulk due to group changes so you may be hitting this protection.

I recommend you open a support ticket with screenshots and configs so we can check if this is the case.

Video only seems to work with VLC, after you download it.

I've seen this protection in action, that's why I created two dummy users so the groups are never empty.

With the steps in the video I can always reproduce the problem.