Forms Authentication Policy Not Working with WAF for people in multiple groups? Bug?

Question

I was having trouble getting a Authentication Policy to work with the form based login. I published a web server using Web Server Protection (WAF), pretty basic. Redirect HTTP to HTTPS and selected my SSL cert and domain name. I selected the web server, which is also HTTPS. For Protection and Intrusion Prevention, during testing, I left both blank. 
 I tested access and as expected I can connect to the internal server just fine without any authentication. But this server needs to have a login from the outside world. So under Web Server -> Authentication Policies I make a basic policy called "Forms without passthrough" to simply give the users a login box without forwarding even basic authentication. In essence using the Sophos as a gate keeper for this site:

I assign the policy to the Web Server Protection rule for the server. I try to access it again and I get the standard Sophos login page. I login and it refreshes back to the login page. Try again and same thing. So I try a test user and that test user worked fine. 
 
 I then tried to hunt down the difference and the only one is my ID is part of a VPN group and the Open group while the test user is just part of the Open Group. So I tested with another user in the VPN group - it failed login again. I tested another user that's only in the open group - it worked. 
 
 So I went back into the authentication policy and added the VPN group along side the Open group. Sure enough now it works. 
 
 Is this a bug in the XG firmware? Shouldn't it check the group I specifically assigned to the policy, which all users are part of? It seems it's not doing this and I would think this is a major flaw. Maybe its checking group membership and stops at the first it finds then compares that group to the allowed ones and is failing without cycling through all groups the user is a member of? How do we get a engineer to look at this? 
 
 -Allan

AllanD · Accepted Answer

Case does not need to be re-opened, it's closed because this is how the XG currently works. But this is not an ideal way of this working and will not work for large "enterprise" deployments with multiple users in different multiple groups with access to different resources. Like said this is fine for a small installation but not for something designed to be a enterprise solution. 
 
 So my question is answered because this is how the product currently works, not because my problem is fixed. Hopefully with v17..... 
 
 -Allan

AllanD · Answer

Called tech support to look things over. Pretty much got a "working as intended" from them which is NOT how groups should work. They said the Open Group, even though I have it set to include everyone authenticated, will only contain those authenticated that are not in AD groups that are pulled in. 
 
 So my VPN group, which I have 40 people in, overrides the Open Group. In other words in a company of 200 if 40 are in the VPN group then the Open Group by default contains the other 160. So in this case I would need to add both groups to the authentication policy. 
 
 I asked what about a scenario where there are multiple users in different group and they said I would have to reorder the AD groups to make sure users fall in a correct order of accessing different things. However there are some situations where this simply won't work if you are protecting access to multiple different sites with multiple different groups and different users in each. 
 
 Long story short groups should, well, work like groups have since they started being used for authentication decades ago. Not sure why Sophos doesn't work in what I think is a industry standard way. A user should be able to be validated in multiple groups and we shouldn't have to order things in a exact way to make it work since they only see the user in the first group it hits. This I consider a very annoying bug. 
 
 -Allan