I just opened a JTAC case for what sounds like the same issue. JTAC suggested deleting the group from the group list and then searching and adding it back. Their suspicion was that the SID in AD didn't match the SID that the IVE had stored for the group. I'm not sure how that would've happened here, however after doing what they suggested the issue is resolved -- users are now successfully mapped to the role. ... View more

I was experiencing this same issue in the lab on 2.2R3 with OAC 4.8. 1st and 2nd level J-TAC could not pin it down. Finally got a conf call with a really experienced guy out of the Cambridge office. He reviewed the OAC and IC config and found nothing wrong. The only thing we did was remove EAP-PEAP from the OAC machine auth config and after that machine auth started working. However, when I added EAP-PEAP back, it continued to work. In the end no one knows what was causing the issue we saw and it has not reoccurred since. .joel ... View more