When a new user is created in Active Directory, the user will get a group membership of “Domain Users” and its Primary Group would be set as ‘Domain users’ by default.
Now Active Directory user John who is a member of Group A, B, C and Domain Users, authenticates with Cyberoam and falls in to Group C on Cyberoam as this Group resides at the top of Cyberoam groups.
Active Directory User Property Screen
Select the user; Right click on userà Properties. Select the Member Of tab as shown in the below screenshot:
Cyberoam User Property Screen
Logon to Cyberoam Web Admin Console with user having “Administrator” profile.
Go to Identity à Live Users and screen will be displayed as shown in the below screen shot:
Scenario 2: User’s Active Directory Primary Group is other than “Domain Users”
If you change or remove the Primary Group from Domain users to other group then on authentication, user will fall under incorrect group in Cyberoam.
Now, again user John has authenticated and will fall in Group B on Cyberoam. The reason behind this is a behavior of Microsoft Active Directory where Active Directory will not send group membership information of primary group.
Here user’s Primary group is set to Group C. Hence, when user authenticates and Cyberoam verifies authentication request with Active Directory, Active Directory will provide group membership information of user John as ‘Group A, B, Domain user’. Now as Group B resides above Group A, John will fall into group B in Cyberoam.
Active Directory User Property Screen
Select the user; Right click on userà Properties. Select the Member Of tab as shown in the below screenshot:
Cyberoam User Property Screen
Logon to Cyberoam Web Admin Console with user having “Administrator” profile.
Go to Identity à Live Users and screen will be displayed as shown in the below screen shot:
· When user has a membership of multiple groups, set primary group as ‘Domain Users’ or the group for which membership
need not to be checked in Cyberoam.
· In Cyberoam, user will fall into a group which is at the top priority (Of which that user is a member) of Cyberoam in case that
user is a member of multiple groups.
E.g.: If user is a member of Group A, B, C on Active Directory and all three groups are imported to Cyberoam then on authentication user will fall in to Group which is at the top priority in Cyberoam manage group.
Document Version: 1.0-17/01/2011
