Dynamic group membership Query based on alert description - IS package failed

Hi there all good people,
Ive got the following case:
i need to filter out some of the alerts raised bij the is package failed Alert rule.
All allerts raised need a override accept two alerts with a specific description. example:
Alert description: Package "Full Back-Up" failed.  should still raise an alert also the
Alert description: Package "Full Db Back-Up" failed.
I.m playing arround with dynamic groups. Can somebody give me some pointers?
Or do i need to create an new alert rule? en override this one for all objects?
I hope the question is clear, im no native english speaking

Hi,
I would like to suggest you override this one for all objects and then create a new alert rule based on your requirement.
Regards,
Yan Li
Regards, Yan Li

Similar Messages

  • AD account used for running SIA locked during group membership querying

    Hello,
    I have code that is querying user / group membership from the BOE repository using the Java Enterprise SDK.  When running against an environment using an AD service account to run the SIA, an error is thrown and the AD account is subsequently locked when I execute my code.  The error is as follows:
    com.crystaldecisions.sdk.exception.SDKServerException: The Active Directory Authentication plugin failed to verify the currently specified administration credentials required to connect to Active Directory. Please contact your system administrator. 
    cause:com.crystaldecisions.enterprise.ocaframework.idl.OCA.oca_abuse: IDL:img.seagatesoftware.com/OCA/oca_abuse:3.2
    detail:The Active Directory Authentication plugin failed to verify the currently specified administration credentials required to connect to Active Directory. Please contact your system administrator. 
    The server supplied the following details: OCA_Abuse exception 10505 at [.\exceptionmapper.cpp : 79]  50068 { ,  , secWinAD}
         ...The Active Directory Authentication plugin failed to verify the currently specified administration credentials required to connect to Active Directory. Please contact your system administrator.   Plugin error: SecWinAD Error: an error occurred in CADCredentialManager::SwitchSecurityContexts().
    If the account is successfully running the SIA, I'm not understanding why this message is being thrown.  Also - I'm assuming some internal login is happening with this AD account when I query for group membership (?), as I am able to query for other types of metadata without error / locking the account.  Based on the error thrown, the authentication with this ID is failing, and is probably being attempted multiple times, resulting in the account being locked?  Can anyone provide insight here?
    Thanks...

    Ted is right on the mark with this one.
    The cause is outlined in the exception indicating a problem with the SwitchSecurityContexts() function.  The Active Directory plugin requires a set of credentials with which to connect to Active Directory and perform any necessary lookups.  Therefore, the issue is not with the account running your SIA (and by extension your CMS), but the Active Directory administration credentials you've set on the plugin (either via the CMC or through code).  When the CMS tries to impersonate, or switch security context to the other account, it fails to authenticate against Active Directory.
    Check to make sure this property is set identically to the account running the SIA, and like Ted said, that you can successfully update the plugin via the CMC.
    Thanks,
    Jim

  • Dynamic group membership detection

    Does anybody know if it is possible to trigger a Workflow action if there is a change in a group’s membership list in case of a dynamic groups. What I need to achieve is to execute PS WF if a user is becoming a member of some groups based on the dynamic
    criteria of the given group.
    Regards, Remi www.iamblogg.com

    Hi,
    ok understood but I think there is nothing out-of-the-box.
    Maybe you can calculate your own Delta of dynamic Groups in a custom activity, storing the before and current value of "ComputedMember". But you must find some way of storing that Information.
    Regards
    Peter
    Peter Stapf - ExpertCircle GmbH - My blog:
    JustIDM.wordpress.com

  • Dynamic group membership biased on service

    I need to create a dynamic group for systems with the DFS service installed BUT not if DFS is there as part of AD replication.
    Any suggestions for a formula?
    tconners

    Hi Tconners,
    I am not so good in AD DFS But,
    Do you have the DFS management pack installed on your SCOM ?
    If yes does it not creating any group from the MS recommended management pack like Active directory creates one and pulls all the Domain controllers in the
    group.
    http://www.microsoft.com/en-us/download/details.aspx?id=14669
    Also look at this 
    http://blogs.technet.com/b/operationsmgr/archive/2010/02/03/now-available-the-dfs-namespaces-management-pack-for-system-center-operations-manager-2007.aspx
    Gautam.75801

  • Dynamic Group Membership - All SQL Computers in a Domain

    I am trying to create groups containing all SQL servers in each domain. I am using the Wizard in the console. However I appear to be having winter blues as I can't work out how to do it. Everything I try results in an empty group.
    Can someone please explain what I need to do to?

    Roger
    Thanks for the input. The code looks logical and I applied it and imported a revised MP. However I am not getting any membership in the group. There is another group membership in the same MP and that populates correctly, so I haven't a clue where I'm going
    wrong. As you can see below my rule is the same as yours, except with a different domain name.
    <Expression>
                 <And>
                              <Expression>
                                           <RegExExpression>
    <ValueExpression>
    <Property>$MPElement[Name="MicrosoftWindowsLibrary7585010!Microsoft.Windows.Computer"]/NetbiosDomainName$</Property>
    </ValueExpression>
    <Operator>ContainsSubstring</Operator>
    <Pattern>DOMAINNAME</Pattern>
                                           </RegExExpression>
                              </Expression>
                              <Expression>
                                           <Contained>
    <MonitoringClass>$MPElement[Name="MicrosoftSQLServerLibrary6410!Microsoft.SQLServer.ComputerGroup"]$</MonitoringClass>
                                           </Contained>
                              </Expression>
                 </And>
    </Expression>
    Eric

  • Urgent! group by query based on a logical OR (bitwise)

    Let's say I have the following table:
    field: f1 f2 f3 f4 f5
    record 1: a a 1 0 4
    record 2: a b 2 3 7
    record 3: a b 0 8 1
    I want to make a group by on f1 so that I get just one record which is:
    field: f1 f3 f4 f5
    record 1: a 3 11 7
    where the result of each field is actually a group by based on a logical OR (bitwise)
    ie:
    3 = 1 or 2 or 0
    11 = 0 or 3 or 8
    7 = 4 or 7 or 1
    any suggestion ?
    Thank you

    You can try using DECODE
    e.g.
    Select F1,
                Sum( Decode( F3, 1,1,  2,2,  0) ) F3,
                Sum( Decode( F4, 3,3,  8,8,  0) ) F4,
                Sum( Decode( F5, 7,7,   0) ) F5
      from your_table
    group by F1
    I want to make a group by on f1 so that I get just one record which is:
    field: f1 f3 f4 f5
    record 1: a 3 11 7
    where the result of each field is actually a group by based on a logical OR (bitwise)
    ie:
    3 = 1 or 2 or 0
    11 = 0 or 3 or 8
    7 = 4 or 7 or 1
    any suggestion ?
    Thank you

  • Grouping Inner Query based on a column.Please help

    I have a strange query.
    I am using Subquery to display the count of rows from the inner query
    depending upon the value of 'Y' or 'N'
    Trade
    id_entity       id_inst_code_type   id_inst_code   dt_trade
    AGL            SE                  5660249        10-Feb-06
    AGL            SE                  5660249        13-Feb-06
    AGL            SE                  5660249        13-Feb'06
    Instrument_xref
    ID_inst      id_inst_xref_type     id_inst_xref  flg_active
    0029010             SE          5660249          Y
    0070789          SE          5660249          Y
    0071190          SE          5660249          Y
    0072385          SE          5660249          Y
    0073215          SE          5660249          Y
    0084797          SE          5660249          Y
    0091375          SE          5660249          Y
    0094690          SE          5660249          Y
    0104438          SE          5660249          Y
    My output:
    id_inst_code_type          id_inst_code   Earliest    Latest       Total    Active
    SE                         5660249       10 Feb 06   13 Feb 06    3        9
    2) If all the 'flg_active' column in Table Instrument_xref is set to 'N'
       the Active should be 0.
    3) Assume that the flg_active could be 3 Y's and 6 N's then what?
    id_inst_code_type          id_inst_code   Earliest    Latest       Total    Active
    SE                         5660249       10 Feb 06   13 Feb 06    3        0
    How do I check for the 'Y' or 'N' value in my code below ?
    Help appreciated as the the functionality changes by the hour...
    select    tie.id_entity             'Entity',
              tie.id_inst_code          'Inst Code',
              min(tie.dt_trade)         'Earliest',
              max(tie.dt_trade)         'Latest',
              count(*)                  'Total',
              dt.InnerTotal             'Active'   
    from     trade_input_event tie,
    (Select  insx.id_inst_xref_type,
                   insx.id_inst_xref,
                   insx.flg_active,
                   count(*) InnerTotal
      from instrument_xref insx
      where insx.id_inst_xref = '5660249'
      ---** Do I need to Check the flg_active here..
      ---** Do I need to use the Having clause here? ie having count(insx.id_inst_xref) = 'N'
       group by insx.id_inst_xref_type,insx.id_inst_xref,insx.flg_active) dt
      where tie.id_inst_code = dt.id_inst_xref
      and tie.id_entity = 'AGL'
      group by tie.id_entity, tie.id_inst_code_type,tie.id_inst_code

    As the flg_active is set to 'Y', I am trying to set it to 'N' in the query
    so that count of 0 is returned, but this displays nothing.
    Please help as to how to display a count(*) of 0 when the flg_active is 'N'??
    Select  insx.id_inst_xref_type,
                   insx.id_inst_xref,
                   insx.flg_active,
                   count(*) InnerTotal
      from instrument_xref insx
      where insx.id_inst_xref = '5660249'
      and insx.flg_active = 'N'
      group by insx.id_inst_xref_type,insx.id_inst_xref,insx.flg_active) dt

  • Newbie Dynamic Group by clause

    Example
    create table test( awhite numeric(6,0)
    , DMonth numeric(2,0)
    , Goalnumber numeric(2,0)
    , Objnumber numeric(2,0));
    insert into test(awhite,DMonth,Goalnumber,Objnumber)
    values(5,6,1,1);
    insert into test(awhite,DMonth,Goalnumber,Objnumber)
    values(8,6,1,2);
    insert into test(awhite,DMonth,Goalnumber,Objnumber)
    values(12,6,2,1);
    insert into test(awhite,DMonth,Goalnumber,Objnumber)
    values(16,10,2,1);
    insert into test(awhite,DMonth,Goalnumber,Objnumber)
    values(4,10,2,1);
    ===========================
    I need this to be ONE query with a parameter
    Select SUM(Awhite) SWhite
    ,DMonth
    ,CASE WHEN &groupbyobj<2 THEN
    to_number('99')
    ELSE
    Goalnumber
    END Goalnumber
    ,CASE WHEN &groupbyobj<3 THEN
    to_number('99')
    ELSE
    Objnumber
    END Objnumber
    FROM Test
    GROUP BY Goalnumber,Objnumber,DMonth
    ============================
    So when the groupbyobj=3, I want the output to look like
    SWHITE DMONTH GOALNUMBER OBJNUMBER
    5 6 1 1
    8 6 1 2
    12 6 2 1
    20 10 2 1
    ==============================
    So when the groupbyobj=2, I want it grouped by GOALNUMBER
    SWHITE DMONTH GOALNUMBER OBJNUMBER
    13 6 1 99
    12 6 2 99
    20 10 2 99
    So when the groupbyobj=1, I want it grouped by DMonth
    SWHITE DMONTH GOALNUMBER OBJNUMBER
    25 6 99 99
    20 10 99 99
    I ADDED the above "99" to the output above. I could not get my query to output that.
    QUESTION- How can I create A DYNAMIC Group by clause based on the parameter
    (Groupbyobj) Selected?
    TIA
    Steve42

    I noticed I got the numbers 1 until 3 just the other way round, so here is a new version.
    SQL> var P_GROUPING_SET number
    SQL> exec :P_GROUPING_SET := 1
    PL/SQL-procedure is geslaagd.
    SQL> select sum(awhite) swhite
      2       , dmonth
      3       , nvl(goalnumber,99) goalnumber
      4       , nvl(objnumber,99) objnumber
      5    from test
      6   group by dmonth
      7       , rollup(goalnumber,objnumber)
      8  having case grouping_id(goalnumber,objnumber)
      9           when 0 then 3
    10           when 1 then 2
    11           when 3 then 1
    12         end = :P_GROUPING_SET
    13  /
        SWHITE     DMONTH GOALNUMBER  OBJNUMBER
            25          6         99         99
            20         10         99         99
    2 rijen zijn geselecteerd.
    SQL> exec :P_GROUPING_SET := 2
    PL/SQL-procedure is geslaagd.
    SQL> select sum(awhite) swhite
      2       , dmonth
      3       , nvl(goalnumber,99) goalnumber
      4       , nvl(objnumber,99) objnumber
      5    from test
      6   group by dmonth
      7       , rollup(goalnumber,objnumber)
      8  having case grouping_id(goalnumber,objnumber)
      9           when 0 then 3
    10           when 1 then 2
    11           when 3 then 1
    12         end = :P_GROUPING_SET
    13  /
        SWHITE     DMONTH GOALNUMBER  OBJNUMBER
            13          6          1         99
            12          6          2         99
            20         10          2         99
    3 rijen zijn geselecteerd.
    SQL> exec :P_GROUPING_SET := 3
    PL/SQL-procedure is geslaagd.
    SQL> select sum(awhite) swhite
      2       , dmonth
      3       , nvl(goalnumber,99) goalnumber
      4       , nvl(objnumber,99) objnumber
      5    from test
      6   group by dmonth
      7       , rollup(goalnumber,objnumber)
      8  having case grouping_id(goalnumber,objnumber)
      9           when 0 then 3
    10           when 1 then 2
    11           when 3 then 1
    12         end = :P_GROUPING_SET
    13  /
        SWHITE     DMONTH GOALNUMBER  OBJNUMBER
             5          6          1          1
             8          6          1          2
            12          6          2          1
            20         10          2          1
    4 rijen zijn geselecteerd.

  • Group Memberships not Flowing into Metaverse

    Hello,
    I'm trying to figure out why the group member attributes in the CS are not flowing into the MV.  Here's what I have:
    An HR system running on SQL Server
    A staging database that extract data from the HR system
    The staging database has a table representing person object
    The stating database has a table representing person multi-valued attributes (i.e location, job code, etc)
    The staging database has a table representing group objects
    The staging database has a table representing group memberships (mult-valued)
    A SQLMA connected to the person and person multi tables
    A SQLMA connected to the group and group membership tables
    All group memberships are based on job codes and locations.  There are no approval process in place.  If they have this job code, they get certain groups.  That's all calculated in the staging database and the memberships are in the group membership
    table
    This system does connect to AD (and a few other things), but I'm not concerned with that, right now.
    I've read 100 articles on this, most of them over 5 years old, and tried the ones that made sense.  The flow from the database into the CS works well.  No issues there.
    But, a search of the metaverse for the group shows an empty member attribute.  The sync process is not throwing any errors.  At least they're not showing up in the sync service app or the event logs.
    Where allowed, I'm using rules extensions for everything.  I can't use a rules extension to set the member attribute because it's an rdn.
    I'm going to move forward with this by extending the metaverse schema and adding a multi-valued string attribute named "memberOf" to the person object.  Then, I'll modify my existing MA to use that attribute instead of the member attribute. 
    I'm not sure what kind of issues I'm going to run into when exporting that to AD.  I'll cross that bridge when I come to it.  I don't anticipate that being an issue as the dns for all these objects will be calculated by the ADMA based on locations,
    group functions and person types (bascially, I don't care about the MV rdn).
    Anyway, I'm looking for some real world insight on this.  This whole effort is to migrate off an existing IDM system that works very, very well but quite expensive to license.
    Thanks,
    Greg Wilkerson

    Hey Cameron,
    I have total control of all the DB tables FIM is accessing.  I build them up as part of IDM process.
    I've read this article, along the many others that address the "manager" scenario.  This really doesn't apply in this case as the user and group objects are loaded in separate MAs.  Getting reference values to flow with both object live in the
    same CS shouldn't be an issue. 
    I also saw a solution where the group and user objects were in the same table and differentiated by the "object_type" value (user, group).  That solution solved the issue of the groups and user being in the same CS.  As I grow tired of my daily
    FIM beatdown, that solution is growing more attractive.  That's a major DB redesign, and seems quite inefficient.
    The multi-value table for group memberships already exists in the DB.  For FIM purposes, I transferred that data into the user object multi-value table.  See screen shot.  I can certainly configure the group MA to access that multi-value table
    and load the group members as references.  But, because the group MA CS will not contain the user objects, I don't see how the references will be set.  If the reference value isn't set in the CS, it's not going to flow into the MV (at least I haven't
    figured out a way to set the an reference value for an object in the MV - my problem all along.
    This whole "setting a reference value" encompasses much more than just group memberships in my implementation.  Telephone resources and physical access (key cards, etc) are provisioned through the existing eDirectory system.  These objects exist
    in our current IDM system and are associated with users based on rules.  So, the reference value process is something I need to figure out, if I'm going to use this product.
    Maybe I could use a stripped down ECMA2 as a "staging" CS, export the users and groups into this CS and assign the reference values, then import the groups back into the MV, memberships intact.  I'm not sure that would get me where I want to go, and
    it seems like a lot of extra "stuff" to solve what should be a simple problem.  Hmmmmmm.  Or, connect the ECMA2 directly to my group membership multi-value table in the DB.  Hmmmmmm.  I'd still have to export the groups and users into that
    CS, but the import might be much more straight forward.  Hmmmmmm.
    The structure of my GroupMembership table (both columns are anchors or directly translatable to anchors):
    EmployeeGroups
        GroupName varchar(50) not null,
        EmployeeID nvarchar(50) not null,
        ID int identity(1,1) not null

  • How to add a dynamic where clause for a sql based VO with group by query?

    Hi,
    Here is my case, I have a sql query based VO with the query like "select status, count(*) StatusCount from my_table group by status". Now I used the following java code trying to dynamically add the where clause to my VO to filter the rows based the type attribute in my DB table.
    vo.setWhereClause("type='MyType1' ");
    vo.executeQuery();
    Then I got the sql syntax error. Looks like the ADF has added the where clause to the end of my sql so my sql becomes "select status, count(*) StatusCount from my_table group by status where type='MyType1' ". But what I expected was the correct syntax "select status, count(*) StatusCount from my_table where type='MyType1' group by status".
    Does anyone know if this is an ADF bug? Or is there any other way to achieve my goal?
    Thanks,
    Chunyang
    Edited by: Chunyang on Dec 13, 2012 9:09 PM

    Hi,
    When you use setWhereClause on the VO, it is applied on top of the VO query. I.e, assume your VO has the following query.
    select empno, ename from empNow, if you apply the where clause programatically, only the two attributes that you are using in the select statement could be used. I.e
    select * from (select empno, ename from emp) where ename='KING' - VALID
    select * from (select empno, ename from emp) where deptno=10  - INVALID (because the inner query - the one you've defined as query for your vo does not have deptno attribute selected)If you would need to set a dynamic where clause, you need to make them available in your select statement / use bind variables.
    -Arun

  • How to create LDAP filter-based rule to check Group membership in OAM

    Hi folks,
    I'm having hard time creating an authorization rule to verify ldap group membership. I've followed "Configure User Authorization" article from Oracle website (http://download.oracle.com/docs/cd/E10761_01/doc/oam.1014/b32420/v2authz.htm#BABHBFEJI) and created an Authorization scheme w ldap_attribute_name as User Parameter and ruleExpression as Required Parameter. Then, inside my policy I created an Authorization Rule based on my Authz scheme w Allow Access attrib filter-based Rule which looks like this:
    ldap://ldap_server:port/ou=People,o=Company,c=US??sub?(ldap_attribute_name=ldap_attribute_value)
    This works fine.
    Now, I've added another filter-based rule under the same Authz Rule/Allow Access:
    ldap://ldap_server:port/ou=Groups,o=Company,c=US?uniqueMember?sub?(&(objectClass=groupOfUniqueNames)(cn=ldap_group_name))
    While query looks somewhat correct and works as a command-line argument (slightly modified format), it does not work in OAM (meaning people w out req-d group membership can still login).
    Can someone steer me to the right direction as to what do I need to do:
    1. Change/fix the ldap query
    2. Create new Authz scheme with uniqueMember userParameter; create new Authz rule based on new authz scheme; create new Allow Access filter rule with the ldap query I have
    3. Do smth else
    Any help is greatly appreciated.
    Thank you, Roman

    You can create two authorization rules
    First for user with attribute
    and second for group
    and then in authorization expression you can have AND of these two.
    Regarding your query...
    First ... If your requirement is to give access to all the members of a particular group then you don't require any ldap filters
    All you have to do is in the authorization rule -> Allow access -> Select People (here you have to select group so click on the group tab, its little hard to see but its there in light blue color on dark blue tab) -> select the group you want to give access
    Second.. If your requirement is such that you want to give access to a member of a group which has certain attribute lets say group with status active ( In this case you are not aware of the name of the group because user can be a member of any group but you want to give access only to the group with specific attribute.) then you have to write custom authorization plugin.
    If the option is second let me know i can give you a solution which will work for a single domain without any effort of developing a major plugin.
    Hope this helps,
    Sagar

  • SQL Query for members of dynamic group - Need to include Name, Path and Type

    Hello,
    I built a custom dynamic group that has all my SQL databases in it using SCOM 2012 SP1.  The group works fine as I can see the Name(ie, Database name), Health State, Path (ie, hostname/instance) and Types (ie; SQL 2005).  Now I'm trying to
    build a custom report based off this same information using a SQL query.   I'm no DBA and could use some help.  So far this is what i have
    use
    select
    SourceObjectDisplayName as
    'Group Name',
    TargetObjectDisplayName,TargetObjectPath
    from RelationshipGenericView
    where isDeleted=0
    AND SourceObjectDisplayName
    like
    'SQL_Databases_All'
    ORDERBY TargetObjectDisplayName
    This gets me the Group Name (which i really don't care about), database name, and hostname/instance. What I am missing is the Health State and most importantly the Type (ie, SQL Server 2005 DB, SQL Server 2008DB).
    If someone could assist me here I would appreciate it. I believe I need to do some type of INNER JOIN but have no idea where the SQL type info lives or the proper structure to use. Thanks
    OperationsManager

    Here's the updated Query for OpsMan 2012 R2:
    To find all members of a given group (change the group name below):
    select SourceObjectDisplayName as 'Group Name', TargetObjectDisplayName as 'Group Members' 
    from RelationshipGenericView 
    where isDeleted=0 
    AND SourceObjectDisplayName = 'Agent Managed Computer
    Group' 
    ORDER BY TargetObjectDisplayName

  • Dynamic group for HSW object based on Site (Gateway) server

    Hi
    Using the SiteName parameter when deploying gateway servers like described in the blog post from Cameron Fuller
    http://blogs.catapultsystems.com/cfuller/archive/2015/02/12/creating-dynamic-groups-for-objects-which-exist-behind-a-gateway-in-opsmgr-part-1.aspx
    I would like to create an aditional dynamic Group with all Health Service Watcher objects related to an Site (Autocreate) Group.
    Any ideas on the XML Query or other ways of duing this?

    Yes I know this one, but the SiteName Group is not in my MP.
    So I need to reference the XML to a Group outside of my own MP.
    Like:
    http://blogs.technet.com/b/kevinholman/archive/2014/04/09/creating-groups-of-health-service-watcher-objects-based-on-other-groups.aspx
    But with the '<MonitoringClass>$MPElement[Name="grouptest.compgroup"]$</MonitoringClass>'
    Line pointing to a autocreated SiteName Group.

  • Active Directory Group membership based on OIM Role

    In OIM 11g, is it possible to determine additional AD group membership based on role membership?
    If it is, could someone point me to documentation or give me a brief description of what to do in order to make this work?
    Thanks!

    In OIM 11g, is it possible to determine additional AD group membership based on role membership?
    If it is, could someone point me to documentation or give me a brief description of what to do in order to make this work?
    Thanks!

  • ACS 5.3 Group Mapping based on AD group membership

    Hi,
    I am configuring a new ACS 5.3 system. Part of the rules is that I want to match the users specific AD group membership, and match appropriatly to an identity group.
    What i'm trying to do is say that if the user is a member of the AD Group (G-CRP-SEC-ENG) then associate them with the Identity Group SEC-ENG. The under the access service, authorization portion, i assign shell profiles and command sets based on Identity Group.
    It seems that the ACS server will not match the AD Group for the user, and it will match the Default of teh Group Mapping portion of the policy every time.
    I tried several configuration choices from : AD1:ExternalGroups contains any <string showing in AD>, AD1:memberOf <group>.
    Is there something special i need to do in the Group Mapping Policy to get it to match and active directory group and result in assigning the host to an Identity Group?
    Thank you,
    Sami

    Ok, my case is like this.
    I use ACS 5.3 for VPN authentication, using AD and an external RSA for token authentication (2 factor authentication)
    I didn't add all the VPN users in the ACS, because it will be troublesome, the users authentication will be managed by AD and RSA server.
    In some cases where we need to restrict a group of user to only access certain resources, downloadable ACL is used.
    Following the Cisco docs, i manage to get downloadable ACL works when the authorization profile matching criteria is username, but when i change the matching criteria to Identity group, the downloadable ACL won't work.
    I have a case with Cisco engineer now and still in the middle to sort things out.
    The advice from the Cisco engineer is to have the Access Service set to Internal User instead of RSA server, but that will require us(the admin) to import all the VPN users into the ACS database.
    Wondering whether there is a fix for this.
    Thanks.

Maybe you are looking for