SurfProtect SSO issues

[Guest Guest]

We're having issues with SurfProtect in that despite users successfully authenticating with SurfProtect (Logs show the username alongside URLs) users are not being assigned the correct access profile. This seems to effect most but not all users, I have two users, both members of the same group, one user gets the correct profile and the other doesn't.

 

The profile has the Groups added but for some reason it just doesn't work.

 

We're unable to contact Exa directly as we aren't a direct customer and have to go via our reseller and their support is useless

 

Has anyone else seen this before?

 

Any help is greatly appreciated

[Michael]

I haven't observed this exact issue, but lately I have observed anomalies. I'm then met with the default/classic response 'no one else has reported these issues'.

 

It's these kind of replies which influence decisions when renewing with providers.

[Guest Guest]

I've always find that if you can get past Link2ICT and speak to an Exa engineer they're very good.

 

Just had a remote session with an Exa engineer, who whilst not able to resolve the issue pointed me in the right direction. The LDIF file uploaded by the SurfProtect task was missing the memberof attribute.

 

I'm not entirely sure if it caused the issue but I suspect when I recently ran and resolved security issues raised by pingcastle I did something which prevents the required attributes being read.

 

Made the SurfProtect account a Domain Admin (only a temporary fix) and now it works fine

[Michael]

I've always find that if you can get past Link2ICT and speak to an Exa engineer they're very good.

 

I agree.