Sounds a little strange. If you want them to sign into the internet with their normal AD credentials, then why have them sign into the computer with the shared account at all? Shared account in an AD environment are never a good idea anyway.
Doing this would be pretty tricky.
Oh, Yah. Shared accounts are a terrible idea. And breaks so many things..
But thats the enviornment at this customer. I'm just trying to get it to work as best as I can for them.
I think if I do some more research into how the various authentication systems work I can actaully get this to do what I want. Just cuious is anybody else has figured out a solution before I go and re-invent the wheel.
1 of 1 people found this helpful
If you want to do it by user group "Shared User", then obviously the account will have to authenticate first to pull the groups.
I would make a rule in the authentication rule set that says, if authentication.UserGroups = "Shared Users", than set it up to somehow use Try-Auth. Put this before the Redirect back from authentication server.
Or maybe even a top level rule set after your Authentication rule set that is only Enabled if authentication.UserGroups = "Shared Users" Then in there put the Try-Auth rules.
I have not done this, but it seems like it would work. Try-Auth will pop up a log in box.
Sounds good. I'll give that a go.
Just as a test I had a rule just where you said before the redirect back. I set it to authentication.UserGroups = "Shared Users" and action of block and it would block the users so I know the rule is firing. I Just wasn't quite sure where to go from there.
Let me know if you have any success.
Hi Jacob, just wondering if you had any luck with this?
I am in the same situation whereby I have a number of staff using a shared account on a few computers and I wish to prompt for additional authentication when they open a browser. There are a few staff that need more access than the rest of the staff and making them authenticate again would allow me to give them this additional access.
Not quite yet. I had some other projects come up and have not been able to make progress on this lately. I hope to have something either working or give up on it next week. : )