Users who are authenticated using AD SSO, why users cannot online on the FW?

For the installing AD SSO service program mode, possible causes and the troubleshooting procedure are as follows:
1.The login and logout scripts are incorrectly configured on an AD domain controller.
Check the login and logout scripts on the AD domain controller. The address and port in the login and logout scripts must be the IP address and port of the AD monitoring service.
2.The AD monitoring service is incorrectly configured.
Check the configuration of the AD monitoring service. The parameter settings of the AD monitoring service must be consistent with those on the FW.
3.The AD SSO configuration on the FW is incorrect.
Choose Object > User > Authentication Domain of the User > SSO Settings and verify that the shared key used during AD SSO is the same as that specified in the AD monitoring service.
4.Check the anti-replay time of the AD SSO service program. Ensure that the anti-replay time is not too short. Otherwise, the AD SSO service program may consider the user unauthorized and does not send the user's login information to the FW.
5.The number of online users reaches the upper limit.
Choose Object > User > Online User and check whether the number of online users reaches the upper limit.
For the monitoring AD authentication packets mode, possible causes and the troubleshooting procedure are as follows:
1.The AD SSO configuration on the FW is incorrect.
Choose Object > User > Authentication Domain of the User > SSO Settings to check whether the Server IP address/port in the AD SSO configuration is the same as that set on the AD server.
2.The number of online users reaches the upper limit.
Choose Object > User > Online User and check whether the number of online users reaches the upper limit.

Scroll to top