The notification from the user access log is as follows:
user1(Realm)[role] - 2011/12/09 09:52:57 - SA6000B - Remote address for user user1/Employee changed from 65.nn.nn.nn to 206.nn.nn.nn. Access denied.
This issue occurs when there is an IP address change at the client side.
Another possible cause is that the user has multiple Network Interface Cards (NICs) enabled and connected to the network (e.g., wired and wireless) and the source IP is changing between them; see Solution for more info.