FSSO vs LDAP groups in Firewall Policy

[doncacciatoconsuting]

Looking into the benefits of FSSO in our environment for the purposes of restricting internet access. What does FSSO give you that a simple LDAP group doesn't within a firewall policy ? Or are they to be used in conjunction ? 

Thanks all!

[AEK · Accepted solution]

FSSO is for passive authentication, i.e.: once user opens a Windows session, he doesn't need to authentication again in order to be allowed.

Using LDAP group (created statically on FGT) should be associated with an active authentication in order to work, like active portal.