Description

Some traffic logs include username and role even though security policy is not configured with source-identity.

Symptoms

Check security policy 123 and there is no source-identity configured. 

root@SRX340> show configuration security policies from-zone TEST1 to-zone TEST2
policy 123 {
    match {
        source-address jtac-10.10.10.100;
        destination-address jtac-10.20.20.15;
        application junos-ssh;
    }
    then {
        permit;
        log {
            session-init;
            session-close;
        }
    }
}
policy 123-indentity {
    match {
        source-address any;
        destination-address any;
        application junos-ssh;
        source-identity "juniper-tac.net\test-group";
    }
    then {
        permit;
        log {
            session-init;
            session-close;
        }
    }
}

But in the session creation log, the username username="juniper-tac.net\jtac-user" and roles="test-group" . 
<23>1 2020-05-10T07:08:01.366 SRX340 RT_FLOW - RT_FLOW_SESSION_CREATE [[email protected] source-address="10.10.10.100" source-port="4206" destination-address="10.20.20.15" destination-port="22" service-name="junos-ssh" nat-source-address="10.10.10.100" nat-source-port="4206" nat-destination-address="10.20.20.15" nat-destination-port="22" src-nat-rule-name="None" dst-nat-rule-name="None" protocol-id="6" policy-name="123" source-zone-name="TEST1" destination-zone-name="TEST2" session-id-32="14285714" username="juniper-tac.net\jtac-user" roles="test-group" packet-incoming-interface="reth1.0"]

root@SRX340>show services user-identification authentication-table ip-address 10.10.10.100
Domain: juniper-tac.net
  Source-ip: 10.10.10.100
    Username: jtac-user
    Groups: test-group
    Groups referenced by policy:test-group
    State: Valid
    Source: Aruba ClearPass
    Access start date: 2020-05-06
    Access start time: 06:56:48
    Last updated timestamp: 2020-05-07 07:00:28
    Age time: 10

Solution

This is an expected behavior. When the source-identity field is specified in any policy within the zone pair, user and role information must be retrieved before policy lookup can proceed. (If all policies in the zone pair are set to any or have no entry in the source-identity field, user and role information is not required and the five standard match criteria are used for policy lookup.)

The User Role Firewall Security Policies explains more detail about user role with security policy on SRX.

If you don't want such traffic related to source-identity, make sure there is no source-identity configured in any security policy in that zone pair. 

For example, remove policy 123-indentity and check new session creation log: 
<23>1 2020-05-10T10:15:03.727 jtac-SRX340-r008 RT_FLOW - RT_FLOW_SESSION_CREATE [[email protected] source-address="10.10.10.100" source-port="6706" destination-address="10.20.20.15" destination-port="22" service-name="junos-ssh" nat-source-address="10.10.10.100" nat-source-port="6706" nat-destination-address="10.20.20.15" nat-destination-port="22" src-nat-rule-name="None" dst-nat-rule-name="None" protocol-id="6" policy-name="123" source-zone-name="TEST1" destination-zone-name="TEST2" session-id-32="14394722" username="n/a" roles="n/a" packet-incoming-interface="reth1.0"]