Product and Software: This article applies to all Aruba controllers and ArubaOS versions.
If either user authentication or machine authentication fails, the user will get the machine authentication default role or the user authentication default role, respectively. The derivation rules, if present, will not apply.
If both machine and user are successfully authenticated, the resultant role is the 802.1x Default role. In case of derivation rules, the rules assigned to the user via derivation rules take precedence over the default role. This is the only case where derivation rules would get applied.