For some of our users in AD, we have set userWorkstations attribute to restrict access to other machines. But this is preventing those users from logging into WebApplications (around 50+) protected by Access Manager(in our case OpenAM).
One way to resolve this issue is to Add the AD-DC name in the list of allowed work stations for that user. But I am not sure about the security implications as a result of this change.
Is there a better way to approach this ?