Chapter 17 Web Authentication
Configure Group Identifier to be the same as Group Membership on the SSO agent.
17.4.6 Configure an Authentication Method
Configure Active Directory (AD) for authentication with SSO.
Choose group ad as the authentication server for SSO.
ZyWALL/USG Series User's Guide
313