Stop clearing ADQuery Identity Awareness during policy installation

David_Herselman — Thu, 20 Dec 2018 04:28:22 GMT

Installing policy has the effect of clearing known user identity awareness, the primary reason why we advocate only handling this outside of business hours.

There are however often reasons why customers ask for policy installations during work hours, is there no way for a security gateway not to clear PDP during this process as user's internet access is subsequently inhibited until they restart their browser (initiates Kerberos browser based authentication as the browser handles captive portal detection), switches or cycles connectivity (initiates captive portal detection) or re-login (initiates ADQuery event)?

Re: Stop clearing ADQuery Identity Awareness during policy installation

PhoneBoy — Fri, 21 Dec 2018 22:37:57 GMT

As far as I know, this shouldn't happen.

There's a note in our Best Practice documentation about something that happens during policy installation, namely we re-lookup all the LDAP groups associated with each user the gateway knows about.

Best Practices - Identity Awareness Large Scale Deployment

That couldn't happen if we cleared all the users on policy installation.

I recommend opening a TAC case.

topic Re: Stop clearing ADQuery Identity Awareness during policy installation in General Topics

Stop clearing ADQuery Identity Awareness during policy installation

Re: Stop clearing ADQuery Identity Awareness during policy installation