WSAM and JSAM

[kg71_]

I see that in setting up a role (student, for instance) it is possible to enable EITHER WSAM or JSAM; however I have no idea whether any particular user is going to be running a windows machine or a mac/linux machine. How do you handle this? TIA....

[muttbarker_ · Accepted solution]

Hmm - well it depends on how automated you want things to be. One option would be to allow the user to choose - if you don't auto-launch then it will just be a menu option for them.

If you don't like that idea then build a Host Check policy that will allow you to determine which SAM they should get and use it in the role assignment process. That would be where you would assign the role based on a custom expression and then create a custo expression that matched on a specific HC policy.

[kg71_]

"...create a custo expression that matched on a specific HC policy." .... that sounds good; we're talkin' students here .... time to RTFM. thanks....

[JHO_]

Kevin,

How would i give my users a choice between wsam & jsam?

Can you offer any ideas on how to configure the host check to laucnh wsam on windows macnines and jsam on OS x macines?

J

[tsm_]

If you would provide WSAM and JSAM for the same resources in your network, you have to create, manage and troubleshoot WSAM and JSAM rules. It is a nice way to double your work.

Be sure that you can handle this.

An easy way to provide WSAM and JSAM at the same time is via different realms, one realm for WSAM and one realm for JSAM.

regards

tsm

[muttbarker_]

Hey J - here are links to to two threads that have a lot of detail on the issue of Host Check and MAC. As another poster indicated the quick and dirty way is to create two realms but then you are dependent on the "honor" system unless you also do a host check to validate whether or not they belong there.

I would start with these two threads and then if you have any other questions - Post them up!

Good luck!

https://forums.pulsesecure.net/topic/pulse-connect-secure/19333-host-checker-detect-linux-or-os-x#M4...

https://forums.pulsesecure.net/topic/pulse-connect-secure/15649-mac-os-1056-and-host-checker

[Russ_]

You could also use a custom sign-in page to accomplish your goal. In the the custom page, use javascript to look at the browser agent string. If it's not Windows then use a JSAM Realm, else use WSAM Realm. If you're interested, I can send you the code.

[kg71_]

I used custom expressions in the role mapping .... one role for WSAM: userAgent = '*Windows*' and another for JSAM: userAgent != '*Windows*'

[Yves_]

Thanks, It's working well for me with the custom expression in th role mapping!

Yves