The MacWorld website has a document on reverting back to earlier versions of Safari such as 5.0.3 or 5.0.5, which work with JSAM. However, they are not for the faint of heart, requiring users to scour the internet in hopes of finding a version of Safari 5.0.x archived somewhere (since Apple does not make it available any longer) downloading that archive, using an additional $20 program to restore the older Safari. In the comments section to the MacWorld article, an additional promising method is supplied (if the TimeMachine backup/restore is not available). When the newer version Safari 5.1 is installed, the system retains a zipped backup of the previous version in the /Library/Application Support/Apple directory. However, the file is named .SafariArchive.tar.gz. The dot at the beginning of the file causes it to be hidden from the gui finder window, so recovering it requires the user to open the command line and use native Unix commands to locate that hidden file, copy it elsewhere, and rename the copy. At that point, the user could then double-click the renamed file in the Finder to launch the Archive Utility to uncompress it and unpack it. Possible, yes, but not pretty. Launch Terminal from Utilities folder Type the following: cd /Library/Application\ Support/Apple ls Ðla Confirm that .SafariArchive.tar.gz is listed Type the following: cp .SafariArchive.tar.gz ~/Desktop/ Type the following: mv ~/Desktop/.SafariArchive.tar.gz ~/Desktop/SafariArchive.tar.gz Locate the icon on the desktop called SafariArchive.tar.gz Double-click the icon to launch the Archive Utility, which will unzip and unpack the contents to a folder on the desktop called SafariArchiveÓ Open the SafariArchive folder; there will be three subfolders; open the Application subfolder to find the older Safari 5.0.5 version. This can either be launched from that subfolder (leaving Safari 5.1 where it is), or user can copy this file over to the main Application folder on the system to replace the newer Safari 5.1 with the older Safari 5.0.5. I have tested this on Mac OS 10.6.8 Snow Leopard, but not Lion, and can confirm that 5.0.5 can be recovered and successfully used to access roles that use/launch JSAM. _ ... View more

Yes, I have seen this as well launching with Safari on Mac OSX 10.6 Snow Leopard. With version Safari 5.0.5, I can wait 30 to 60 seconds, and then click the reload button to force it to load. I tested Safari 5.1 this morning on the same device and it seemed to hang completely at the host checker loading page; even trying to reload did not work. ... View more

I agree that Juniper is providing lousy service. Why can't the OPSWAT folks get the products into their review and packaging pipeline sooner? Especially for such major AV vendors as Symantec/Norton and McAfee. It should not come as a surprise when these vendors release a new product. Why does it take so long for OPSWAT and then Juniper to get their act together to get these products recognized by ESAP? This has been a problem for several years and Juniper apparently doesn't care about it because they are doing NOTHING to improve the situation. Shame on Juniper!!! ... View more

I have been testing 6.5R2:EA1 (build 14813) provided by JTAC. The predefined OS checks for Windows page does not list Windows7 as an option. ... View more

There are a couple of options here: To prevent Mac or Linux users from logging in to a particular realm in the first place, just require "Cache Cleaner" to be loaded. (On the authentication policy for Cache Cleaner for the realm, select "Load and enforce cache cleaner.") Since cache cleaner only loads and runs on Windows platforms, this will prevent Mac and Linux users from logging into this realm. The reason you might want to do this is for realms that map users to resources that only work on Windows, such as applications requiring WSAM. In our case, we have some roles that auto-launch WSAM (so that would only work for Windows users), while we have others that auto-launch JSAM (for the Mac users). If you want to have all users log in to the same realm but map them to different roles based on OS and antivirus host check, you'll need at least two different roles (one for Windows, one for Mac/Linux) and three host check policies: one to pick out Mac/Linux users, one to pick out Windows users, and a third to require Windows users have the proper antivirus. Of course you could combine the Windows and antivirus checks into one host checker policy, but I find it cleaner to separate the two. This also allows a third "restricted" role, for Windows users who pass the OS check but fail the antivirus check. You can then use expressions to mix and match the host checker policy results to map users to the appropriate roles. To pick out Mac/Linux users and prevent Windows users: "Unix check" Windows tab: "Process" rule type: Criteria--Process name * ; Action "Deny" Mac and Unix tab same: "File" rule type; Criteria--File name: /tmp/* ; Action "Required" Pick out Windows users and prevent Mac/Unix users: "OS check" Windows tab: "Predefined-OS Check" rule type: Criteria--Specify windows OS * Mac and Unix tab same: "File" rule type; Criteria--File name: /tmp/* ; Action "Deny" The "antivirus check" would only pertain to the Windows tab; leave the Mac and Linux tabs blank. Then, you can create role mappings using custom expressions: Unix role: map based on custom expression " hostCheckerPolicy = 'Unix Check' " Windows full role: map based on custom expression " hostCheckerPolicy = 'OS Check' AND hostCheckerPolicy = 'antivirus check' " Windows restricted role: map based on custom expression " hostCheckerPolicy = 'OS Check' AND hostCheckerPolicy != 'antivirus check' " Final realm/role mapping would be either a catch-all bare-bones role such as "user=*" - map to Basic role, or none at all if you want to prevent logins that don't pass some sort of host check. ... View more

This is very helpful.  Thanks for your reasoned reponse and guidance. In your experience, is it useful for consumers to contact their ISP who is providing the AV package (in this case, Comcast providing the Norton product), or should we encourage them just to contact the AV vendor? ... View more