Remote user sync rule

[akhan2]

Hi Everyone , 
I am facing a strange issue with sync rules. I have created sync rule to import the remote LDAP users. Sync is not happening correctly  because it does not reflect the correct users of the remote LDAP group.

I move the user to another OU  which is not part of the filter and the user is not removed from the group. I have also deleted the user for test purposes and user still remains in the remote users.

[dbu]

Hi @akhan2 ,
Check if this option is enabled on the remote user sync rules : "Do not delete synced users when they are no longer found on the remote server" .

If enabled , disabled it and test again . 

[akhan2]

Hi @dbu , This option is disabled, which means user should be removed  correct?

[dbu]

Yes if the option is disabled the user should be removed from the group in FortiAuthenticator.
Can you try a manual sync of the rule and check the logs if you see something related.

[akhan2]

I did a manual sync of the rule and can see something like : 

Sync rule ... was aborted because LDAP server returned an empty result.
How to fix this ?

[dbu]

It looks like there are no more users on this remote group. Can you verify ? 

[akhan2]

Correct this is a test group with only one user. 
After I remove this user the group is empty, which means that sync rule should remove it also ?

[dbu · Accepted solution]

This error is received because are no users on the this remote LDAP group and as result the sync rule is failing to run.
This explains why user is not getting deleted.
Enable the option : Proceed with rule even when response empty . 

Check and let me know if it helped. 

[akhan2]

Now it is clear. After enabling this option and run a manual sync of the rule user was removed from the group.
Thank you for help and explanation.