Juniper NETWORK AND SECURITY MANAGER 2010.4 - CONFIGURING SECURE ACCESS DEVICES GUIDE REV 01 Manual page 222

Configuring Secure Access Devices Guide
204
Table 53: Role Mapping Rules Configuration Details (continued)
Option Function
Stop processing Specifies if you want the
rules when this device to stop evaluating
rule matches role mapping rules if the
user meets the conditions
specified for this rule.
Role mapping rule Specifies the type of role
type mapping rule.
is/is not Specifies the conditional
expression used in the
NOTE: This option
rule.
is enabled only if
you select either if
username or if
certificate has any
of the attributes
as the role
mapping rule type.
Your Action
Select Admin Realms > Role Mapping Rules
> Settings > Stop processing rules when this
rule matches to enable this option.
Select If user name if the role mapping
parameter must be based on the user name.
Select is/is not conditional expressions for
the rule, click the Add button, and enter the
new user names.
Select If certificate has any of the attributes
if the role mapping parameter must be based
on the certificate attributes. Select is/is not
conditional expressions for the rule, click the
Add button, and enter the new values.
Select If user has any of these custom
expressions if the role mapping parameter
must be based on the custom expressions.
The collection-of-expressions button
appears.
1. Click the collection-of-expressions
button to assign expressions. The
expressions that were created for the
selected authentication server appears.
2. Select an existing expression from the
Non-members area and click Add to
assign the expression to the role-mapping
rule.
3. Click New and create an expression to
assign a new expression to the
role-mapping rule. For information on
creating custom expressions and using
the Expression Dictionary, refer to
"Creating a Custom Expression for an
Authentication Server (NSM Procedure)."
NOTE: You can create a custom expression in
a device template, but you cannot validate the
custom expression. The Validate button is not
enabled in the Custom Expressions editor for
device templates.
Select an option from the drop-down list.
Copyright © 2010, Juniper Networks, Inc.