Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
RUtony
New Contributor

FG101f User cannot be added to User Groups

I have a 101f with 7.2.6. User cannot be added to user groups.

 

Under User and Authentication, User Definition

I select a user that is an LDAP user,

I select the User Group button and the list of available user groups pops up.  I select a group      from the list and when I save it I get an entry not found error.

 

if I do the opposite from the groups:

Under User and Authentication, User Groups

I select the same user group I was selecting above and edit.  there is no option to add users.  If I jump out to the CLI and manually try to add the user I get:

 

entry not found in datasource

value parse error before 'xxxxxx'
Command fail. Return code -3

 

The listed LDAP servers are connected successfully and can authenticate users through the FG interface under Under User and Authentication, LDAP Servers.

 

what did I miss?

1 Solution
hbac

@RUtony,

 

Have you tried with different groups? You can create a new group for testing. 

 

Regards, 

View solution in original post

8 REPLIES 8
mle2802
Staff
Staff

Hi @RUtony,

In the second scenario, when click on the group, you don't see the option too add member or there is no desired users? Can you please upload the screenshot of what you are referring?

Regards,

RUtony
New Contributor

 

2024-02-14 08_19_20-FortiGate - fbh-mdf-fw13.jpg

AEK
Honored Contributor II

In LDAP server configuration (User & Device > LDAP servers), which value did you set as "Common Name Identifier"?

By the way, in that section, click "Test user credentials" then test it with that user credentials.

AEK
AEK
RUtony
New Contributor

Testing creds works as advertised.  Common Name = sAMAccountName

hbac

Hi @RUtony,

 

Does it happen to all users and groups? 

 

Regards, 

RUtony
New Contributor

I only have three user setup and it is the same for all three of them.

hbac

@RUtony,

 

Have you tried with different groups? You can create a new group for testing. 

 

Regards, 

RUtony
New Contributor

OK, here is what I have figured out.  It appears that you cannot add users to an LDAP group from the FG GUI.  They have to be added in AD which makes perfect sense and you cannot see them on this interface.  When I created a local group as suggested above everything worked fine including the view that had no members earlier.  I deleted the local users altogether and LDAP still worked as advertised based on membership in the LDAP server in AD.

Labels
Top Kudoed Authors