SA Simulation - Fails to check users AD groups

[netdefilr_]

I can do simulations on local users, but not AD users.

Is there any way to do this? It seems like the roles that get applied to AD users are roles that

are set to Any. I think simulations are very useful but in an AD environment it doesn't work.

Thanks,

Tim

[zanyterp_]

you are correct: simulation does not query the AD server. This means group-based rules cannot be tracked; this is by design. i will post the KB link once I find it again 

[netdefilr_]

Is there any alternative to role mapping with AD?

[zanyterp_]

What are you trying to accomplish? You can role map with groups or usernames with the AD/NT (and LDAP) server type; however, simulation is not a valid way to check for group membership. If you want to see what the groups returned for a specific user, use the policy trace and let a user login. This will trace the groups that are being evaluated for the user as well as if the AD server response.

[netdefilr_]

It would be nice to use simulation if possible, because 1. it doesn't require the user to login to troubleshoot and 2. I would like to see what roles a user matches. Including a stop rule so the user doesn't apply to more roles underneith that stop rule.

[zanyterp_]

OK; thank you for the information. Unfortunately, the system cannot do that at this time. It is a good idea for those reasons; I would recommend that you contact your account team/local Juniper team and work with them for an enhancement request. The KB that discusses this limitation is KB19777 (http://kb.pulsesecure.net/KB19777).