Security

Hello

We got a clearpass in which we configured a selft registration with mac autentication.

Automatically it give you one day

 

The problem is the fallowing

Some users need more than one day, so the admin goes to the clearpass guest  console and change teh expiration date

The expiration date is changed!

 

But the account then is disabled after one day

For example

The user register today January 12 - 2015

 

The user needs 5 more days

 

The admin goes to the cleaprass guest console and change the expiration date to January 17 - 2015

 

Then on January 13 the user says he cannot log in.   You check on the clearpass guest console  and you see the account disabled! but the expiration date is correct! on 17 - 2015!

But as the account is disable then he can no longer use the guest

 

Anyone  can help me here? how you can fix this how can you change the expiration date along with the disabling date manually when its needed????

 

Cheers

Carlos

 

Have you tried adding it under the guest edit option and then add the amount you would like to allow that to be valid :

Well i though in doing that but im not sure if this is related to the expiration time

What i mean is that if i put for example one week in there that the selft register give everyone 1 week instead 1 day.

 

They still want that all the accounts that are done by selft service work just 24 hours.

 

But they want to be able to edit this to any time they want after.

 

Are those 2 values edited in different sides???? if so you already told me where you modify the disabling time!

Now were do you configure the expiration time???? i mean the default one.

 

You get my question?

 

Cheers

Carlos

 

 

Totally , you may need to create a new edit_expire_time field with a different value since the one I mentioned above you are already using it with a value of 24 hours

Try this out:

Duplicate the expire_after field:

 

Then add the duplicated field to the guest_edit form:

edit the current expire_after field

 

Add the new one:

 

Then you can add the value you would like to use

 

Hope this helps

 

Bello Víctor
How does the cleaarpass know which value belongs to the disabled time and which one belong to expiration time

Remwnber that un muy selft registration IT seems that the expiration time and the disablibg the account time is the same

What i originally understood was that there are 2 fields

 

expire_time

expire_after

 

I have to set expire_time to 24

i have to set expire_after to some crazy value so it wont disable me the account

 

isnt this what i need to do?

 

Cheers

Carlos

That particular expire time value leave set to 24 but your issue is when the sponsor or edit the account and extends the time for value longer than 24

In order to fix you need to set the value in a new expire after to a longer period and then added to the guest_edit form

Well we had to do some changes as the client wanted that the client could pick an specific time in which it will expire, so we  changed the expire after to modify expire time for that...

 

So now we will test if it happens also the issue of the disabled account IF the admin need to modify it for more time i mean the same account...

I cannot test it right now because the admin had to go so we will have to continue that specific test for tomorrow or wednesday..

ill let you know :)

 

Cheers

Carlos 

Carlos

Can you make sure you open a TAC case on this. I spoke with engineering and they have not seen your issue before. Sounds like you are missing a setting somewhere or a bug.

Hello Troy

Thanks for appearing in my topic :)

 

Well after switching to modify expire time beause the client was asking us that they wanted that their guest could pick how many days they needed in the selft registering form.   We did a test, we created a new user with the selft register and just give it one hour, and then modify it for 2 more days.   The account didnt disable this time.

 

Yes i had a suppport ticket open, but as we switched to modify expire instead of  expire after we didnt try again with that.

 

So i could not say if it happens again as the configuration is not the same.

 

The thing is that in first place it was expire after, and the admin took an screenshoot of the account disabled and the expirity time expiring like in febrary....  It was weird.

I was not able to test it myself because they asked us to change the form.... and also fix that.. as it was easier to make the new form we did that first.

The admin did say that it happened to him with all the accounts that he edited though.

 

Anyways they dotn have any issues right now as we did test today with the new way of registration and that problem did not happen.

 

Sorry that this didnt solve the mistery though...

 

Cheers

Carlos

Thanks for the reply. Just post here again if you see the issues and I will see what I can do. You can just send me a PM with a backup and I will try to also replicate.

Thanks Troy 

This is my first clearpass installation and the client its really happy with it :)  which im glad :)

 

Anyways im happy i got all the support in the forum for this, and also with the tac :)

 

Cheers

Carlos