ACS 5.4 Access Policies Problem

Hi Gents,
I've been trying to troubleshoot this for a long time but I'm out of ideas now. here is the topo. I've got a Cisco ACS 5.4 VM used for Radius Network Authentication with a Cisco WLC 7.0, I've done the initial setup and all the rules, everything was working perfectly so far. now i'm trying to add more Access Rules (Identity/Authorization), it seem ok in the GUI interface and it is saving the configuration even if I reboot the Appliance, however when I check the Monitoring and Report log the new rules are not matching. I will attach some print screen for that.
in the identity part there is a rule matching users that attribute Radius_IETF Username start with "g_" without quotes to identify them with local database. "JV1\" to identify them using Active Directory (this is the old rule that was working) the Default is Deny Access
in the authorisations, for the users that attribute Username start with "g_" they got a service policy X and for the "JV1\" they get a service policy Y.
the new users added in the local database (starting with "g_") are matching in the identity store but in the authorisation they hit the default rule which is deny access. the only condition in the authorisation is to be part of the identity group "Wireless Users".
I've had this issue with ACS 5.2 in the past and I used to delete the rule than create it back again but it doesn't seem to be working for the version 5.4
thanks & regards,
Habib

I ran into this issue as well on my ACS 5.4 and never found a bug that matched. I ended up installing the latest patch and I havent had any issues since.
Thanks,

Similar Messages

ACS 5.2 NDG Locations not showing up in Access Policies

When I add locations under Network Device Groups and then try and use them in my Access Policies they don't show up. It just says "No data to display". If I try and recreate them I get an error "Object you are trying to Create already exists.' but it is blank. I can run an export and they show up in the CSV file but they don't show up anywhere on the GUI. I have deleted the file and recreated with the same result.
I have been searching all over for anyone with a similar situation but have come up empty. Any thougts?
Regards,
Andy

I have recollections about two issues related to this:
- If there are mutliple attributes with the same name as the NDG. Eg if create a user attribute called "Locations" it can cause problems. Can be resolved by renaming the attribute
- Could be issues if word "system" appears in NDG node name
Not 100% sure for these (disclaimer) but wanted to mention in case it gives some pointers

Problem with Access Policies (create multiple resources)

I'm having a problem with Access Policies:
The first policy must create a resource.
And the following policies should create childs on the resource.
The problem here is that when policies will add the childs, the resource is not provisioned yet.
And then each one will create a resource but i just want one resource with the childs.
When the resource is already provisioned, the policies update this resource properly.
How can I fix this?
tks

Ricardo,
I had a similar problem. In a post-process handler I was managing the user membership in specific roles through the removeMemberUser and the addMemberUser of the tcGroupOperationsIntf class.
The last parameter of this method was a boolean which, when true, would automatically trigger the access policies programmatically in the post-process.
The problem is that there also is an OOTB event handler for triggering access policies, so I was basically triggering the access policies twice and duplicated resources were appearing.
Hope this helps.
Cheers

ACS v5 best practice w/ access policies.

Hello, I am in the process of deploying a ACS v5 appliance with 2 network devices talking through it to MS Active Directory via LDAP. It works great but I have a design question.
Our current access policy has one AD group match, one AD attribute match, and network device type is valid. If those 3 items match then permit access. Pretty simple. But my question is specific to the network device type. Is it best practice to have one large access policy with different network device types OR have one access policy per device type?
For example, lets say I have a 3000 series Concentrator and a 5500 series ASA and logging into the network via there devices I have the same IT support person and I am pulling the AD attribute msdialin=TRUE.
One Access Policy
1: IT Support memberOf=VPN User Allow Dial in=True Network Device=VPN 3000
2: IT Support memberOf=VPN User Allow Dial in=True Network Device=ASA 5500
Or have two Access Policies, one dedicated to each device type?
Access Services
>VPN 3000
>Authorization
1: IT Support memberOf=VPN User Allow Dial in=True
Access Services
>ASA 5500
>Authorization
1: IT Support memberOf=VPN User Allow Dial in=True
Just not sure which way to go. Any help is greatly appreciated.
e-

Hello, I am in the process of deploying a ACS v5 appliance with 2 network devices talking through it to MS Active Directory via LDAP. It works great but I have a design question.
Our current access policy has one AD group match, one AD attribute match, and network device type is valid. If those 3 items match then permit access. Pretty simple. But my question is specific to the network device type. Is it best practice to have one large access policy with different network device types OR have one access policy per device type?
For example, lets say I have a 3000 series Concentrator and a 5500 series ASA and logging into the network via there devices I have the same IT support person and I am pulling the AD attribute msdialin=TRUE.
One Access Policy
1: IT Support memberOf=VPN User Allow Dial in=True Network Device=VPN 3000
2: IT Support memberOf=VPN User Allow Dial in=True Network Device=ASA 5500
Or have two Access Policies, one dedicated to each device type?
Access Services
>VPN 3000
>Authorization
1: IT Support memberOf=VPN User Allow Dial in=True
Access Services
>ASA 5500
>Authorization
1: IT Support memberOf=VPN User Allow Dial in=True
Just not sure which way to go. Any help is greatly appreciated.
e-

Provision a RO several times with one user using Access Policies

Hello,
we need to provision several Unix machines and for this purpose, we use one only resource object (SSH User). Additionallyl, we created an access policy for every machine:
- Access Policy Unix Server 1
- Access Policy Unix Server 2
- Access Policy Unix Server N
We created the following group in OIM: SSH Group.
We set the policies in such a way that whenever a user is added to the SSH Group, the SSH User RO is provisioned with the user for every machine. We created several access policies, because the parameters of the form are different for every machine.
The problem is that when a user is added to the SSH Group, the SSH User resource object is provisioned only once. It is provisioned by the access policy with the highest priority. We would like that the SSH User RO was provisioned by every access policy. That is, the user should have the SSH User RO provisioned N times, after adding it to the SSH Group.
Is there any way to achieve this without creating a resource object for every Unix Machine? We need to provision more than 300 Unix machines and this would require a lot of time...
Thank you for your help

There are other options. You could create a child table to hold the IT Resource information, assuming all parent data is the same for every system. Then on the insert/delete to child table entries, you can provision and de-provision from that target. On disable/enable you would need to search through the child table and perform the action against all instances. The same for the other update tasks.
This is the limitation of access policies. They manage a single resource object target instance. You could also code a generic resource that has child table entries. When an insert happens, you can use the APIs to provision and instance of the specific target with the provided details. Then you could create access policies to add entries to the child table, and each would provision the appropriate object, and deprovision too.
Takes some custom code, but it's doable. Just remember though that they are all still the same resource object, so reporting would show them all, as well as attestation, as a single instance, with multiple provisioned to each user.
Another option is to duplicate the work flow using find and replace in the XML and generate a unique workflow for each instance.
-Kevin

Security exception when provisioning using multiple access policies

We have upgraded our eDirectory connector to version 9.0.4.12. When provisoning manually all process tasks work correctly. However, when provisioning through an access policy or multiple access policies, once the edirectory Create User task runs it creates a security exception and all other connectors fail to provision until retried. We have set the system config parameter of Access Policy Multiple Resource Enhancement to TRUE and we have set the account discirminator in the process form to Server. Why would it fail?

I have the same problem. Have you solved your problem, if so please let me know what the solution is.
Einar �rn

OIM 9.1.0.2 - Access Policies issue

Hi Gurus,
I have facing a strange behavior in the Access Policies features.
When users are inactived in the OIM, they should be removed from the groups associated to the AP, but the groups remain associated and because that the AP is triggered again provisioning resources to the users.
Has someone faced the issue?
Brgds,
Carlos

What does all of your group membership rules look like? Are you sure your right side is the correct format? You can create a rule where Users.Status = "Active". Just need to make sure it's case sensitive so you'll want to check the database for existing values.
-Kevin

Feature Request : provide a way to create access policies or identities with matching condition based on the HTTP header's "Referer" field

Hello,
I have a use-case I would like to share with you. When a customer configures its WSA with highly restrictive internet access like in the example below, it may trigger some issues :
1- allow internet access only for URLs defined in whitelist.
2- block ALL other requests.
Let's take the following example :
1- the customer only allow requests to www.siteA.com. siteA.com is the only URL included in its whitelist.
2- www.siteA.com contains many embedded objects (such as facebook like tags, youtube videos, links to partners sites, ...)
In this configuration, the end user will be allowed to reach siteA but the page will not be fully displayed. All the embedded objects not directly located on siteA will be missing.
With WSA, the easiest way I can imagine to solve the issue is to list all the embedded objects present on siteA, get back their URL and also add these URLs to the whitelist. But this solution if of course far to be really convenient since it involves to know exactly how each HTTP page you want to consult is built.
With other proxies, such as Bluecoat proxies or McAfee Web Gateway proxies for example, I used to solve this kind of issue by using the HTTP referer field (the URL you come from). For example with Bluecoat :
<Proxy>
ALLOW request.header.Referer.url.domain=//www.siteA.com/
=> All requested objects from siteA.com will be automatically allowed by the proxy, even if they are not part of my whitelist.
- Do you have a better suggestion than the one I'm currently using with WSA (adding each sites in whitelist) ?
- Would it be possible to add the field HTTP referer as a matching condition for Identities and access policies in your next release ?
Thanks in advance
Best regards

As far as I'm aware this functionality is still not available... would be an awesome feature to have, but could also be abused at the same time by a user writing their own "middleware" proxy and setting the referrer header to that allowed site.. could be done in like ~15 lines of perl / python.
Either way... would still be a cool feature to have.

Issue in OIM 11gR2Ps2 while provisioning using access policies

Hi,
we are provisioning resources using access policies, we are facing any issue while provisioning resource using two access policies. we are populating the main process form data using two access policies, according to the access policy priority we are seeing the first access policy form data value in the user process form, but the second access policy value is not showing in the user process form, for example we are populating processform fieldvalue1 using access policy1 and processform fieldvalue2 using access policy2.
Thank you,

Hi,
we are facing issue in the following scenario
we are provisioning a resource based on the user position through access policies, for example a user position "contractor" is satisfies two rules based on the rules he will get two roles, these two roles trigger two access policies, and two access policies giving same resource for example "AD", in AD main process form there two lookups(lookup A,lookup B), we are giving looukp A value in acess policy1 and lookup B value in access ploicy2, when ever user gets AD resource through these roles, after provisioning when we see the user process form only lookup A value is there and lookup B is empty.But i want to get both lookup A,lookup B values, what i observed was based on the priority access policy values are comming to user resource form, the next access policy form values are not reflecting the user process form.
Thanks,

E4200 Firmware 1.0.03 Parental Controls/ Intenet Access Policies not kicking in.

I have configured my e4200 to block traffic at certian times uses both the Parental Controls and the Intenet Access Polices. Neither one seems to work though. The traffic just keeps flowing.
I have the following summary in my IAP:
1    9toMidStoT                 Deny Sun, Mon, Tue, Wed, Thu   21:30 - 23:55
2    midto6AMEveryday   Deny   Every Day                              00:00 - 06:00
3    AllowDays                  Allow Every Day                                06:00 - 21:30
4    Late Allow Fri, Sat                                    21:30 - 23:55
Each of the four rules is enabled.
I have the same MAC addresses specified in each rule. Initally I had only the first two rules. Those didn't work, so I added rule 3 and 4 (they do the same thing as rules 1 and 2 but from the opposite direction). There are no compliaints, but they don't stop any traffic.
I started with the Parental Controls, they didn't work either. The page in there that lets you pick which machines you want to block seemed next to worthless. I have about four rows listed as "Network Device." REALLY LAME! As the MAC addresses are accesible and these weren't working I went to the IAP.
Does anyone else have this working? Is this feature broken in 1.0.03? I had it working in 1.0.01.
Thanks!

What happens when you set "block internet access" to always? I have also had weird experiences with this feature.
For example, as I am typing this message, I have instructed the router to block all internet access on this computer (using parental controls), yet I am still able to visit this forum; although, other websites are blocked. I'll also try your rules and see what effect they have on my computer.
I also agree with you about the annoying "network device" issue that happens when the router isn't able to identify the devices' hostnames. There are also devices that appear in that list, which haven't seen in my DHCP table for awhile.
I don't work for Cisco. I'm just here to help.

How to Map OIA Provisioning policies to OIM Access Policies

Hi,
Access policies in OIM does not allow entitlements definition in it such as defining the AD Groups that needs to be attached to the account which would be provisioned on the target resource when the access policy gets triggered. These entitlements definition in OIM is taken care on the Process Form level, whereas in case of OIA the Provisioning polices allow entitlements definition according the resource type in the policy level. It would be of great help if you could help us in understanding how the import and export of access policy data between OIA and OIM would be feasible with these differences in place
Secondly the access policies defined in OIM can contain resources belonging to different resource types unlike the OIA where we can create access policies only pertaining to the selected resource type, Kindly let us know how the Import and Export process would workout in this scenarios as well
Appreciate your guidance and support
Thanks
Avinash

Hi,
Any helpful pointer on above mentioned scenario ?
Thanks,
RPB

Access rights problem

I have set up two OID instances to talk between one another and think I have the mapping files correct.
I now see Insufficient Access Rights in the logs. Does anyone have any ideas what this could be? Does the exchange between servers run under a specific user?
orclOdipSynchronizationStatus: Mapping Failure, Agent Execution Not Attempted
orclOdipSynchronizationErrors: Error Creating Entry in OID
Sleeping for 1secs
Exception creating Entry : javax.naming.NoPermissionException: [LDAP: error code 50 - Insufficient Access Rights
]; remaining name 'cn=[email protected],cn=users,dc=hoc,dc=test,dc=com'
[LDAP: error code 50 - Insufficient Access Rights]
OIDUserImport:Error in Mapping EngineODIException: DIP_OIDWRITER_ERROR_CREATE
ODIException: DIP_OIDWRITER_ERROR_CREATE
at oracle.ldap.odip.gsi.LDAPWriter.createEntry(LDAPWriter.java:975)
at oracle.ldap.odip.gsi.LDAPWriter.insert(LDAPWriter.java:328)
at oracle.ldap.odip.gsi.LDAPWriter.writeChanges(LDAPWriter.java:239)
at oracle.ldap.odip.engine.AgentThread.mapExecute(AgentThread.java:406)
at oracle.ldap.odip.engine.AgentThread.execMapping(AgentThread.java:262)
at oracle.ldap.odip.engine.AgentThread.run(AgentThread.java:155)
Regards

Do let us know if you find the answer. I've been stuck for days on an LDAP access rights problem.

Hi, Trying to log in with my user id and password at iocbc but was not able to access. Problem message shown : Applet not initialised or may not be supported. Please refresh the page or check the browser setting Anyone can advise? or i need to download?

Hi,
i have the same problem?
Trying to log in with my user id and password at iocbc but was not able to access.
Problem message shown : Applet not initialised or may not be supported. Please refresh the page or check the browser setting
Anyone can advise?

You need to install Java for your Mac OS version, and/or make sure it's enabled in the Java Preferences application and your browser's preferences.

OIM - Priorities for Access Policies

Hi
In my OIM deployment I have 7 access policies that I use to provision different resources. Each of these has a separate priority (naturally).
While provisioning a new user these polcies are applied in decreasing order of priority. (i.e policy with priority 1 is applied first and policy with priority 7 is applied last) - atleast as far as one can tell from the order of the email notifications.
How can I configure OIM in such manner that while de-provisioning a user these policies are applied in the reverse order (i.e policy with priority 7 should be applied first and so on till the last policy that is applied is the one with priority 1)?
Any help will be appreciated.
Thanks in advance

Use the APIs to add the group name to the group name child form of the AD process form.
Or write a custom connector that does the group add directly to AD.
Both approaches works but approach one is more elegant.
Best regards
/Martin

How to set access policies

Hi,
I have a wrt54g and would like to set the access policies to allow two laptops to have access 24/7 and to block any other machines that try to connect wirelessly.
Is this possible with the access policies? And if so how would I do it?

Better way to do it is setup a wireless mac filter
you can find it under the wireless tab
regards,
appu.

ACS 5.4 Access Policies Problem

Similar Messages

Maybe you are looking for