About pspecht

pspecht · ‎03-21-2022

We currenly have a single realm and two role mapping rules. One for users who are restricted to VPN in only between certain hours (6:00 AM and 9:00 PM) enforced by an expression (groups="VPN Non-Exempt Staff" AND loginTime = (6:00AM TO 9:00PM)) and another that allows any VPN access time if they are in an AD group "VPN Users" If a user in the "VNP Non-Exempt staff" logs in at 8:55 PM they should be allowed due to the expression time frame. BUT... shouldnt the Dynamic policy evaluation re-eveluate and then end the users session soon after? We have it set for 60 minutes and both Refresh roles and Refresh resource policies checked.

pspecht · ‎02-28-2022

freed96, I created another realm (just copied my exsisting) sO I can test. Same LDAP settings In Role Mapping I created two rules matches expression "VPN Allow Login Window" XPRession: groups="Test VPN Users" AND loginTime = (6:00AM TO 9:00PM): assign these roles - Users Role matches expression "VPN Not Allow Login Window" XPRession: groups="Test VPN Users" AND loginTime != (6:00AM TO 9:00PM) Assing no role When I test my user account after being moved from the VPN allowed users security group to the Test VPN Users group the logs show "Login failed. Reason: No Roles" What am I missing?

pspecht · ‎02-24-2022

Im trying to follow this article https://kb.pulsesecure.net/articles/Pulse_Secure_Article/KB43638 But I cant seem to figure it out. I dont want to restrict all users I would like to set up restrictions for Non-Exempt employees so they cannot authenticate after a certain time. I have a windows security group (Non-exempt Employees) that I have added those users to. Im lost on how to add this to an exsisting realm. Currently we have a VPN users group with everyone in it and assing a role and NO time constraints

End active sessions after certain hour

Re: VPN restrict users in group and time

VPN restrict users in group and time