Security

So I can see how I can create custom Create Device pages in Clearpass Guest,  the problem I have is how I can associate multiple pages with one user.   I have for instance a HelpDesk User who may need to add a Wireless device, for MAC authentication, straightforward process,  but I also have  Wired 802.1x I want to allow the HelpDesk user to define specific roles for the wired user (not avalbile for wireless user)  I also want to be able to have a listing "View Devices"  for both wired and wireless that are filtered differently.  Is there a way to put custom entries into the menu system?

 

 

 

That user's ClearPass guest role would have access to all of those fields.
Essentially would have a form view for each variation of access and tie them
to CPG roles.

But this is still a one user to one form ratio correct?  THe helpdesk user would not have multiple forms avalible from the same login.

 

 

 

One form per role. You essentially need to create a list of access roles, create forms that match what you want them to be able to do then create the logic in policy manager to map the users to their roles.


Thanks,
Tim

Ok, So currently I have that configured.  Helpdesk gets one form, Students get a different form for adding their personal devices.  The main issue is regarding having the different forms for different functions, it sounds like it is not possible to have both of them linked via the menu.. however i could link to them individiually from a different webpage correct?

 

 

I'm not sure I understand. You can only have one mac_create form per role.
If you try to go to another version of the form, it will revert you to the
one that is mapped to your role. Why not just create one form with all of
the different fields?



Can you give us an example of what is different between the two forms?

So I agree that one page could do everything that role is allowed, however sometimes it is nice to compartmentalize things based on the specific task.  For instance if I may be trying to:  Add a wireless device (mac-trac)  specify a device as specific type ie printer, game console, phone. so that it can get a vlan or role. Or configure a devices Airgroup information.  Sometimes this can be confusing for the end user when it is all on one page, kind of an information overload.   I think the best way will probably to make a simple form and use the Clearpass API.  Thanks for all the help

 

 

Matt

I tend to enable AirGroup in the background and hide the enable fields. Then change the descriptions for each of the fields and add links to make it more user friendly.


Thanks,
Tim