Symptoms

if the option "fetch primary group" is enabled for AD Query AND some attributes are configured as "required attributes" then AD Query request only those configured attributes for a user during logon process. If the required attributes missing primaryGroupID attribute, then AD Query will fail as it cannot find primary group DN for the user

Impact

AD Query fails

Conditions

the option "fetch primary group" is enabled for AD Query AND some attributes are configured as "required attributes" AND required attributes missing primaryGroupID attribute

Workaround

add primaryGroupID attribute to the list of required attributes. it's not necessary if "required attributes" list is empty - in this case, bigip retrieves all attributes for a user including primaryGroupID

Fix Information

None

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips