Security

Hi Experts,
I have a cluster design CPPM and I want to integrate it to AD. Do I need to integrate it also from the subscriber's perspective or only in the publisher?
Thanks

If you're using PEAPv0/EAP-MSCHAPv2 and each node is authenticating clients, then they all need it be joined to the domain.

Hi cappalli,
Thanks again for your help.
I am using EAP-TLS for authentication.

Then you do not need to join your servers to the domain.

Hi cappalli,
But actually what we will do is to get the CN in the certificate the and check it against the AD. So meaning we still need to integrate it to the AD.

You do not need to join the ClearPass servers to the domain. You only need to set up an AD authentication source that will be used for authorization.

hi cappalli,

yes you are correct but before we can set the AD as authentication source we need to integrate the CPPM cluster to the AD right? Do I need to integrate also the subscribers?

All authentication source configuration is done on the publisher.

yes, meaning the AD integration will in the publisher only and not also in the subscribers?

No. Just like most of the other configuration that is done on the publisher, it will work on all nodes.