I'm having the same problem as YB, except I'm not migrating from a testing environment.  I am able to log into Portal 0 through our Juniper MAG and view all tabs of the site.  However, when I log into either of the two children portals through the MAG, I get the message "You do not have access to view this tab within the portal."  The user is logged in successfully.

In my Authentication Settings of the DNN_ADAuth, I have enabled AD Auth.  I checked Synchronize Role.   I have ADSIAuthenticationProvider for Provider, Delegation for Auth Type, correct Root Domain, User Name (with read access to AD), Password, Email Domain, and Auto-login IP Address.  I get a green check and box showing a successful update.

I have created Security Roles for each portal and have ensured that they matched the Pre-Windows 2000 Group Name in AD.  I have also ensured that, within each tab of each portal in the Page Settings on the Permissions tab, there is a green check next to the Security Role under View Page and no checks or red mark for any of the other roles (except Admin).  I have created one user each in each of those groups, within AD.

When I go to either of the children portals, and go to Manage Users in Role, the user does not appear and is not an option in the User Name drop down to Add User to Role.  When I attempt to add the user manually in DNN, it will not let me because the user already exists.

All of this works fine for Portal 0.  We contracted with a "professional" web developer and he got Portal 0 working by adjusting some settings in IIS.  We have since parted ways.  I have followed instructions from the following link:  http://www.getyourowntots.com/Blog/tabid/57/EntryId/218/Setting-up-Dotnetnuke-DNN-to-work-with-Active-Directory.aspx and my IIS settings appear to be correct, but I'm not sure and I think this is the only other piece that could be misconfigured.

Any guidance is much appreciated!

DNN Version 6.1.5, DNN_ActiveDirectoryAuthentication 5.0.4, IIS7