/var/log/proton/nsxapi.log
has the logon event but the user is not mapped to any group2021-05-17T19:54:24.469Z INFO IDFW-Vertical1 UserToParentGroupsCache 5573 INVENTORY [nsx@6876 comp="nsx-manager" level="INFO" subcomp="manager"] Loading user from LDAP: CN=Doe\, John (VDI User),OU=example,DC=com
2021-05-17T19:54:25.385Z INFO IDFW-Vertical1 IdfwEventProcessorImpl 5573 FIREWALL [nsx@6876 comp="nsx-manager" level="INFO" subcomp="manager"] 1/1: no mapping to add, none of user's parent AD-group(s) are in any NSGroup
VMware NSX-T Data Center 3.x
This issue is resolved in NSX-T Data Center 3.1.3
Workaround:
If an upgrade is not possible, the only workaround is to create a new user that does not use the special characters in its dname or edit an existing users to remove those characters.