>> And if I recall, the groups are only returned if they match a local pfSense >> group (must have the same name). > That doesn't make sense, (...) And yet this is what the pfsense documentation explicitly says... And the behavior I am observing here.