I think I created two realms as I couldn't use my existing roles for the Mac's as we use the cache cleaner and this didn't work with the Mac OS. So I had to configure additional roles that didn't use the cache cleaner. So I thought it was easier to have another Realm with mapping to the new Mac roles that I created. This has worked well in the past, I just don't know why it's not working with this particular user. ... View more

The differences between the two realms is the way the host checkers operates. In the Windows realm it checks for an active and up to date antivirus. In the Mac realm it basically just checks if it is a Mac (looks for a running process). That's the only difference between the two. As I do the Host checking at the resource level, I have created duplicate resources with different host checker settings, one for Mac and one for Windows. The particular url that go through determines which realm they use, and which resources they can map too. I ran a Policy trace and I can clearly see that the user is going through the Mac realm, but I can't see why when I am being assured that they are using a Windows computer and going through the Windows realm (based on the url they are going through) Hope that makes sense. Message Edited by meh on 05-02-2009 11:16 PM ... View more

Just been released. ... View more

ESAP v1.4.8 has just been released and according to the Release Notes it fixes the AVG 8.5 issues. Message Edited by meh on 04-15-2009 03:17 PM ... View more

I have to say when I said v1.4.7 fixed my problem, I meant in XP. I haven't had the requirement yet where are using is running Norton's on a non-XP machine. I'm sure it will come up soon so hopefully Juniper can sort this out as well as the AVG 8.5 issue. ... View more

Well just to clarify we are doing our host checking at the role level, not the realm level. In the Host Checker section I configured a HC Policy called MAC Check. The purpose of this is to ensure it is a user with a Mac OS trying to connect and a Windows user. What this policy does is checks for the existence of a process called launchd. Then I duplicated some of our existing roles that these Mac users required and removed our standard HC policy (checks for antivirus) and added this Mac check policy, meaning only Mac users can access this role. Then I created a new realm just for the Mac users eg. https://xyz.com/mac and created role mappings to these new 'Mac' roles I created. I created a hyperlink on the login screen of our main realm indicating if you are a Mac user then click here, to take them to the Mac realm. This may not be the most efficient way of doing it but it seems to work for us. Hope this helps. Message Edited by meh on 03-22-2009 03:55 PM ... View more

Upgrading to ESAP 1.4.7 fixed this for me. ... View more

Well I downloaded a 15 day trial version of Norton AV 2009 and updated our version of ESAP to 1.4.7 and to my surprise it works. The new version of ESAP has fixed the Norton's problem :-) Message Edited by meh on 03-12-2009 08:04 PM ... View more

I just noticed there is a ESAP v1.4.7 now available. The doco states: Norton Internet Security 2009 (v16) is now detected on a 32_bit XP with Security Centre disabled. (399877) Does anyone know about this version release and if the bugs are fixed? Thanks ... View more

Thanks for testing this for us. I'll have to do a work around in the meantime I think which is frustrating. I'm very disappointed in the fact that Juniper puts in their documentation that this is supported when it's not. Not impressed. Let's hope they fix this prior to taking 1.4.6 out of Beta. Message Edited by meh on 03-12-2009 03:48 PM ... View more

The only thing I can think of doing temporarily until Juniper gets their act together, is put a Host Checker rule in place that checks for whatever process is used for the Norton 2009 realtime scanner, and ensure that process is running. Not great cause it won't check if the definitions are up to date, but maybe it's better than nothing at this stage. I'm having to this for eTrust at the moment. Message Edited by meh on 03-11-2009 07:57 PM ... View more

I've just had confirmation from the user that it still does not work. Reading the documentation for 1.4.5 it looks like it should be supported. So any assistance would be great. Thanks ... View more

I didn't realise I was running ESAP 1.4.1. I've just updated to 1.4.5 and am waiting for the user to test and let me know how it goes. Keep you posted. ... View more

OK guys you'll have to forgive me for my stupidity. I found the problem. With all my testing and stuffing around I ended having the role mapping for this group part of two realms, so obviously it was failing as it didn't know which realm to authenticate me against. Thanks for your help ... View more

Just noticed if I hard code the username into the role mapping, it works fine. For some reason the issue seems to be with group membership. ... View more

Well I've checked netbios names, etc and everything is looking fine. I do a Test Configuration in the Auth Server area and it tests successfully with no errors. I do a seach in the Role Mapping area and it can see all the groups in that domain. It also authenticates the user successfully at login, but it just cannot seem to see the user is part of the group I have specified to have access to this particular role. I even selected the group from the list of search results to ensure I wasn't typing it in incorrectly. I'm at a loss so any other assistance would be great appreciated. Thanks ... View more

No I haven't tried installing the Juniper Installer service. I guess as most times it is users accessing Juniper from their home computers I assumed they would all have admin rights. But I might give them a copy of the installer to put on their pc to see if this makes any difference. With firewalls, I guess I wouldn't know what people use for firewalls at home or when they're at remote locations, anything is possible. I haven't had any way say they were getting firewall pop up messages. ... View more

Yep, this worked well. Mac is working as expected. Thanks for your help. ... View more

Still waiting to see if this works but I was just thinking that by moving the HC policy to the Mac tab rather than the Windows tab, wouldn't this mean a Windows user could use this realm as the HC in this realm is not configured to check anything in Windows? ... View more

Good advice. I'll give it a go and see what happens. Do I have to specify the path for "launchd"? If so what is the location? Sorry I know nothing about Mac's. Thanks ... View more

OK, in the Auth server, I have now selected "Use LDAP to get Kerberos realm name" rather than specifying the kerberos realm name and now my Test Configuration works and I can click on Search to bring up all the group. However, for some reason the role mapping still doesn't appear to work? Found this in the trace log which is probably causing my problems: Info PTR23397 2009/03/06 08:34:34 - Fetching machine config from ntjoinserver for domain xxx failure Info PTR23397 2009/03/06 08:34:34 - Winbind Authentication initialization did not succeed Info PTR23397 2009/03/06 08:34:34 - There are no groups obtained for the user Message Edited by meh on 03-05-2009 02:40 PM Message Edited by meh on 03-05-2009 02:41 PM ... View more

Just noticed when I go into the auth server for this new domain and click on the Test Configuration button I get a message stating: Error while joining domain. Possible causes: - The specified administrator credentials do not porpoerly authenticate - The specified domain or domain controller may not be valid. Again I believe I have the right details and permissions but obviously I'm missing something. ... View more

Hi, When I click on Search I get a message "Failure to access the groups information due to network connectivity problems or invalid information." The service account I am using has domain admin rights already, so not sure why this is occurring. ... View more

Well I had the user connect from home last night with her Mac to test for me (I don't have a Mac to test with) and unfortunately she says it still didn't work. I basically created a HC rule that checked for the presence of c:\windows\explorer.exe and if it existed then it was determined to be a windows user and they would be denied access via this particular "Mac" realm. I didn't put any Mac HC rules in place. It sounds like the HC is failing to load on this Mac OS for some reason. It is needing to load to check if it is a Windows pc or not. I'm only going by what she is saying that she is running version 10.5.6 but maybe she's running something else. I'm at a bit of a loss? ... View more

I did do a Policy trace in the Troubleshooting section and basically all it is saying is that the user does not map to any role. In relation to the groups in the role mapping rules, I click on the Group button and added in a new group (manually typing it in) then selected it from the list. I used the format domain/group name. ... View more