Role Mapping Misorders After AD Group Rename
A hospital maps AD groups to Aruba roles in a single 802.1X service. Role mapping rules, in order: (1) memberOf contains 'CN=Nurses' → role 'clinical'; (2) memberOf contains 'CN=Doctors' → role 'clinical'; (3) memberOf contains 'CN=Contractors' → role 'restricted'; (4) else → role 'employee'. IT renamed the AD group 'Contractors' to 'Vendors'. Contractor accounts now land in 'employee' instead of 'restricted'. Some contractors are also members of 'Nurses' (for shared clinical systems). After the rename, those dual-membership contractors get 'clinical'. The customer wants contractors always restricted regardless of other memberships.
1. Explain why dual-membership contractors get 'clinical' and how rule ordering causes it.
Read the worked answer
Role mapping evaluates rules top-down and stops at the first match (first-match wins). Rule 1 (Nurses → clinical) precedes the contractor rule, so a user in both Nurses and the contractor group matches rule 1 first and never reaches the contractor rule.
Additionally, the contractor rule still references the old group name 'CN=Contractors', so after the rename it no longer matches - contractors who are not in Nurses fall through to the else → 'employee'. That explains both symptoms: pure contractors get 'employee', dual-membership contractors get 'clinical'.
2. Rewrite the rule logic to guarantee contractors are always restricted, and note any side effects.
Read the worked answer
Because first-match wins, the most restrictive rule must be first:
- memberOf contains 'CN=Vendors' → role 'restricted'
- memberOf contains 'CN=Nurses' → role 'clinical'
- memberOf contains 'CN=Doctors' → role 'clinical'
- else → role 'employee'
Update the group name to 'Vendors' to reflect the rename. Side effect: vendors who legitimately need clinical access will now be restricted - confirm with the customer that this is intended (it is, per their requirement). Also audit any other services or enforcement policies that reference 'CN=Contractors' so the rename is applied consistently.