Security

 View Only
last person joined: 6 hours ago 

Enterprise security using ClearPass Policy Management, ClearPass Security Exchange, IntroSpect, VIA, 360 Security Exchange, Extensions and Policy Enforcement Firewall (PEF).
Expand all | Collapse all

UPN authentication with clearpass and active directory

Jump to Best Answer
This thread has been viewed 18 times
  • 1.  UPN authentication with clearpass and active directory

    Posted Sep 24, 2014 09:18 AM

    I have Clearpass authenticating iPhones and Androids.  I need to pass the UPN authentication from Clearpass to Active Directory to have Clearpass make a decision.  Both phones authenticate via a certificate.

     

    My Android phones authenticate with the AD SAM username. EX ncci/ncdlt. The iPhones try to authenticate with the UPN. EX daniel_tominovich@ncci.com.  The Androids work and the iPhones do not.

    How do I get Clearpass to pass the UPN on to AD for authentication?



  • 2.  RE: UPN authentication with clearpass and active directory

    EMPLOYEE
    Posted Sep 24, 2014 09:20 AM
    Under the authentication tab (at the bottom), try stripping the domain using the "user:@" syntax.


  • 3.  RE: UPN authentication with clearpass and active directory

    Posted Sep 24, 2014 09:49 AM

    I tried that and it had no effect on the authentication.

    Thanks



  • 4.  RE: UPN authentication with clearpass and active directory
    Best Answer

    Posted Sep 24, 2014 01:16 PM

    Changing from this:

     

    (&(objectClass=user)(sAMAccountName=%{Authentication:Username}))


    to this:
    (|(&(objectClass=user)(sAMAccountName=%{Authentication:Username}))(&(objectClass=user)(userPrincipalName=%{Authentication:Username})))

     

    was the fix.



  • 5.  RE: UPN authentication with clearpass and active directory

    Posted Sep 21, 2018 04:37 AM

    Hi!

     

    Many thanks for this authentication filter - still best choice for this scenario.

     

    I've added the AD badPWDCount to the filter so that Clearpass does not pass wrong credentials to AD after 4 tries:

     

    (&(|(&(objectClass=user)(sAMAccountName=%{Authentication:Username}))(&(objectClass=user)(userPrincipalName=%{Authentication:Username})))(!(badPwdCount>=4)))

     

    With kind regards

    Manfred M.



  • 6.  RE: UPN authentication with clearpass and active directory

    Posted Aug 14, 2020 01:41 PM

    Griaß di Manfred!

     

    Aged post but - thank you for sharing that filter combination.
    Saved me time

     



  • 7.  RE: UPN authentication with clearpass and active directory

    Posted Aug 10, 2022 05:32 AM
    Hello,

    i need help with OU i add the:
    (&(objectClass=user)(sAMAccountName=%{Authentication:Username}))

    for username and work great, now i want add ou for department name any help ?

    thank you


  • 8.  RE: UPN authentication with clearpass and active directory

    EMPLOYEE
    Posted Aug 10, 2022 07:55 AM
    You responded to an old discussion and your question is unrelated to the topic (OU and UPN are mutually exclusive).

    Please open a new post and explain what you want to achieve.

    ------------------------------
    Herman Robers
    ------------------------
    If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

    In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
    ------------------------------