Juniper NETWORK AND SECURITY MANAGER, Руководство пользователя

Страница: 222 / 340

Table 53: Role Mapping Rules Configuration Details (continued)
Your Action Function Option
Select Admin Realms > Role Mapping Rules
> Settings > Stop processing rules when this
rule matches to enable this option.
Specifies if you want the
device to stop evaluating
role mapping rules if the
user meets the conditions
specified for this rule. Stop processing
rules when this
rule matches
•
Select If user name if the role mapping
parameter must be based on the user name.
Select
is/is not conditional expressions for
the rule, click the Add button, and enter the
new user names.
• Select If certificate has any of the attributes
if the role mapping parameter must be based
on the certificate attributes. Select
is/is not
conditional expressions for the rule, click the
Add button, and enter the new values.
•
Select If user has any of these custom
expressions if the role mapping parameter
must be based on the custom expressions.
The collection-of-expressions button
appears.
1. Click the collection-of-expressions
button to assign expressions. The
expressions that were created for the
selected authentication server appears.
2. Select an existing expression from the
Non-members area and click Add to
assign the expression to the role-mapping
rule.
3. Click New and create an expression to
assign a new expression to the
role-mapping rule. For information on
creating custom expressions and using
the Expression Dictionary, refer to
“Creating a Custom Expression for an
Authentication Server (NSM Procedure).”
NOTE: You can create a custom expression in
a device template, but you cannot validate the
custom expression. The Validate button is not
enabled in the Custom Expressions editor for
device templates.
Specifies the type of role
mapping rule. Role mapping rule
type
Select an option from the drop-down list. Specifies the conditional
expression used in the
rule. is/is not
NOTE: This option
is enabled only if
you select either
if
username or if
certificate has any
of the attributes
as the role
mapping rule type.
Copyright © 2010, Juniper Networks, Inc. 204
Configuring Secure Access Devices Guide