Security

Hi,

 

I've been trying to configure tacacs with AD authentication this whole week but no success. 

Can someone tell me, how to authenticate against specific AD group? Now Clearpass is allowing all AD users to log in to network devices. I want that only users in specific AD group are allowed to log in to network devices.

 

Thank you very much for you help!

 

 

Need to post a screen shot of your role mapping and enforcement profile.

Hi,

 

how are these settings related what Clearpass is looking from Windows AD?

All I want is that if user belongs to TACACS group at windows AD it is authenticated, otherwise not.

Because in either the role mapping and/or enforcement you need to have a "member belongs to x group" if you share a screen shot then we can tell you if it is setup correctly

example

 

 

Hi,

 

mine looks like:

 

 

 

"Tacacs-FullAccess" is the AD group where the allowed users belong to.

 

You don't need to define it in both the role and enforcement. I only do it because I use two separate domains and want to get more granular..

you also have in your default as an allow, so if the user was just found in AD then you will allow all. That should be like mine where if they don't fit my conditions then it sends a reject.

Hi,

 

I switched the default to "Not_allowed" but still all AD users are able to log in to network devices.

 

 

 

You need to just delete the role mapping. Only use enforcement and you need to change the default there

Role mapping is essentially and grouping function. It only needs to be used if you want to tag a multiple conditions to one role. Roles are not required.

Hi,

 

I removed Roles from usage and setup Enforcement as under:

 

 

Now the problem is that no one is able to log in to network devices. My authentication Source is:

 

 

Problem NOT solved!

Looks like you added a filter to your AD source. Put that back to the default.

Looks like you added a filter to your AD source. Put that back to the default.

Hi,

 

this solved the case. Thank you both for your help!

Ok so it's not done under the "Authentication" tab? 

Like "Look users from this specific AD group"?