FG101f User cannot be added to User Groups

[RUtony]

I have a 101f with 7.2.6. User cannot be added to user groups.

Under User and Authentication, User Definition

I select a user that is an LDAP user,

I select the User Group button and the list of available user groups pops up.  I select a group      from the list and when I save it I get an entry not found error.

if I do the opposite from the groups:

Under User and Authentication, User Groups

I select the same user group I was selecting above and edit.  there is no option to add users.  If I jump out to the CLI and manually try to add the user I get:

entry not found in datasource

value parse error before 'xxxxxx'
Command fail. Return code -3

The listed LDAP servers are connected successfully and can authenticate users through the FG interface under Under User and Authentication, LDAP Servers.

what did I miss?

[mle2802]

Hi @RUtony,

In the second scenario, when click on the group, you don't see the option too add member or there is no desired users? Can you please upload the screenshot of what you are referring?

Regards,

[RUtony]

[AEK]

In LDAP server configuration (User & Device > LDAP servers), which value did you set as "Common Name Identifier"?

By the way, in that section, click "Test user credentials" then test it with that user credentials.

[RUtony]

Testing creds works as advertised.  Common Name = sAMAccountName

[hbac]

Hi @RUtony,

Does it happen to all users and groups? 

Regards, 

[RUtony]

I only have three user setup and it is the same for all three of them.

[hbac · Accepted solution]

@RUtony,

Have you tried with different groups? You can create a new group for testing. 

Regards, 

[RUtony]

OK, here is what I have figured out.  It appears that you cannot add users to an LDAP group from the FG GUI.  They have to be added in AD which makes perfect sense and you cannot see them on this interface.  When I created a local group as suggested above everything worked fine including the view that had no members earlier.  I deleted the local users altogether and LDAP still worked as advertised based on membership in the LDAP server in AD.