User field in WebProtection populated only occasionally

Question

Dear All, 
 
 we are about to get a quota (2 hours a day) set up for youtube and facing some issues... 
 So far I have created a WebFilterProfile (LimitYoutube) in standard mode: 
 
 As I do not want to mess all else up I created it only for myself. Allowed networks is me. 
 to this I set up a WebFilterPolicy (YoutubeLimit) that is set to my userID (Only Users and groups allowed, no IP-s)
 
 Time=Anytime 
 Filter Action is named LimitStreaming
 
 This filter action has all categories set up to "quota" and 120 minutes.

The issue is that always the policy set for all users hit and never the specific one. For the sake of understanding, the specific WebFilterPolicy is also in first place at the very top, also the WebFilterProfile. 
 in the logs, another problem that may be the cause is that (my ip is x.x.x.x and my user is "user") the field user is only occasionally populated, but nonetheless... even if the correct user is there, it just jumps over the policy created for my user. If I set hte WebFilterProfile to my specific IP, than that profile hits, but the WebFilterPolicy is again jumped over and goes to the default straight. Appliance is AD Joined and user sync log shows: 
 2019:07:30-00:00:06 user_prefetch[21954]: 38 user objects were found: 2019:07:30-00:00:06 user_prefetch[21954]: 0 users were created 2019:07:30-00:00:06 user_prefetch[21954]: 38 users were updated 2019:07:30-00:00:06 user_prefetch[21954]: 0 users are authenticated locally. 2019:07:30-00:00:07 user_prefetch[21954]: Overall time: 0m 4s 
 
 The device acts as a DHCP Server in the NW. 
 
 Device: SG210 Appliance 
 Firmware: 9.603-1 
 
 Any help appreciated! 
 Thanks in advance!

Gergö Karpati · Answer

Thanks for the Reply, I have now figured out with your help! 
 now I have the quota for all http sites, and we use nowhere SSL Interception, but still if I open up any https page it shows the SelfSigned cert from the UTM. 
 Am I missing something again, or can it be that it automatically Intercepts SSL? 
 Thanks for all the Help so far!

DouglasFoster · Answer

1) Your users have to hit a Filter Profile that specifies Authentication. 
 2) If a website has an exclusion for Authentcation, the Authentication process is not invoked so the user is not logged. 
 3) With HTTPS Inspection ("decrypt and scan") off, UTM cannot do AD SSO authentication because the SSO information is in the encrypted portion of the packet. As a workaround, it assume the user is the last username seen on an http request from the same source IP address. If there is no prior http request, the user is unauthenticated and the unauthenticated user policy is applied. Workarounds: 
 
 Add an http internet page to your startup page policy. Google, Youtube, and many other sites use only https, but will redirect an http request to https. Any of these should be sufficient to trigger authentication. 
 Or enable decrypt-and-scan. 
 
 Also be aware that with decrpt-and-scan disabled, UTM only sees the host name (FQDN), not the full path and querystring, because this information is also encrypted. Consequently, regular expressions that reference the path will not be matched. 
 If you use regular expressions, check your syntax carefully, it is easy to make mistakes.