Higher Education

If I use the Clearpass Admin Access (Active Directory) wizard to add Read Only / Help Desk users and set it up like so:

 

 

Will my local superuser admin account still work?

 

Thanks Gang!

Yes, local admin users will always work 

Sent from Nine

Thanks Cappi!!!

Okay Cappi, riddle me this; I go through the wizard and set everything up, choosing our existing AD server that is already set up and with the appropriate AD groups. Yet it keeps failing. Access tracker keeps telling me it cannot find me in the local database. Why is it looking there when I thought we just set it up to look to AD for it?

 

Also, at the beginning of the wizard, it asks for a prefix, what prefix would that be?

 

(I am not an AD guy so this is new territory for me)

Under Configuration -> Services, the services are accessed in order from top to bottom. I believe that, by default, a new service is added at the bottom to minimixze disruption on a production server.

 

You can use the Reorser button to move your new service before others.

---

@bosborne@liberty.edu wrote:

Under Configuration -> Services, the services are accessed in order from top to bottom. I believe that, by default, a new service is added at the bottom to minimixze disruption on a production server.

 

You can use the Reorser button to move your new service before others.

---

The reorder did the trick! Thanks Bosborne !

Keep in mind that every modification to a service and/or addition of a service rewrites the radius.cfg file in the backend. Always best to make changes to production systems in maintenance windows... #duh

- Ryan -

Ryan,

 

Have you seen any issue makeing modificatons during producton?

 

Obviously, when addinfg a new role it is best to enter the role mapping last to minimize disruption.

It was an extraordinary disruption. Our identity team that provided our service account for LDAPS authorization neglected to disable password expiration. Our password expired, but services sustained because ClearPass maintained the LDAP sockets opened. When we modified a service, it rewrote the radius.cfg, causing the sockets to close and attempted to reopen. At that point, the password had already expired and authorization began to fail. Full wireless outage.

I only mentioned it so folks know that's what happens in the background. I didn't before, and now that I know that affecting one service can touch/affect them all, I'm much more cautious. I tread very lightly with ClearPass changes.

Many times you will noticed requests that cannot be processed after making a
change at high traffic times.