Show "Access is disallowed under read-only mode" when trying to add AD group in Role Mapping Rule

[dhlao]

My user account is the administrator of Pulse Connect Secure.

In User Authentication Realms > Role Mapping. Trying to create new rule based on Group membership. Click the Groups button, and I suppose there should be a list of AD groups allow me to select. But it show "Access is disallowed under read-only mode".

Anyone know the meaning ?

[joepope]

Did you add the groups to the IVE? Got To Role Mapping to add a new rule. Change the rule based on: to Group Membership and click UPDATE. Drop down to Available Groups and click the GROUPS... button. The Server Catalog for LDAP should show up. Enter the NAME in the box and click SEARCH... button.
Select the Matching DNs and click ADD SELECTED.

If nothing is found make sure the Base DN & Filter is displayed/set correctly (Base DN: dc=yourcompany,dc=com Filter: cn=* (must fit to your AD structure!).

[dhlao]

The "Access is disallowed" message was showed right after I click "Role Mapping" > click "New Rule" > choose "Group membership" > click "Update" > click "Groups...".

I think the page you mentioned - "The Server Catalog for LDAP" was the one that showed "Access is disallowed".

[dhlao]

And in Auth Servers settings.
1. Type is LDAP

2. Under "Determining group membership
Base DN: DC=mycompany,DC=com
Filter: cn=
Member Attribute: member
Nested Group Level: 2

[dhlao]

Filter: cn=GROUPNAME (have triangle blanket at the front and end)

[zanyterp]

Please confirm you are using IE & connecting via IP (or using another method in which there would be a certificate mismatch, such as shortname or internal DNS name that is not on the certificate). If yes, that is an expected error due to restrictions in IE that does not automatically send cookies for untrusted sites [sporadically]; you will need to close that pop-up and open it again; it _should_ allow the cookie to be sent that will let you select the groups.

[dhlao]

Use IP address to access the admin page do the tricks. By the way, the SSL cert of the domain was expired. So it always show Certificate error.

[zanyterp]

Glad to hear you are able to connect to pull the groups