Wrong Webfilter Profile being used

Hey everyone,

I'm facing a weird issue on one of my clean Astaro installations.

I set up Active Directory groups

Astaro-FullAccess
Astaro-LimitedAccess
Astaro-NoAccess

and connected them to Astaro groups with the same names using backend membership.

If I use the test authentication mechanism under "authentication servers", the correct group is being displayed for the user (Astaro-FullAccess, for example).

good, so far.

I set up Web Filter profiles in the following way

Action -> assignment -> profile

Astaro-FullAccess -> Astaro-FullAccess -> Astaro-FullAccess
Astaro-LimitedAccess -> Astaro-LimitedAccess -> Astaro-LimitedAccess
AstaroNoAccess -> AstaroNoAccess -> AstaroNoAccess

now, when a user from the Astaro-FullAccess group is accessing the proxy, he is getting the "Astaro-LimitedAccess" profile (checked it in the live logs)! But he should get the Astaro-FullAccess profile, as he is member of that group!

How can that happen? What am I missing here?

Thanks in advance.

Cheers
Micoud