Hi,
For Extension V5, is it in Cluster deployment or standalone? Because, if it is in cluster (Extension on both nodes), Extension IP should be the same in both nodes.
Info from manual:
"HTTP Authorization Source Mode
In this mode we configure an HTTP Auth source that results in a TCP call to InTune during endpoint authorization.
In this deployment model the extension must be installed on every cluster node that process authentications.
Also in this scenario every cluster member's extension must be set to the exact same IP address during installation time, as the HTTP Auth source configuration is propagated globally across all cluster members."
Intune as HTTP auth source is working (in my environment, cppm version 6.9.7.131609) when Base URL is
http://extension_ip/device/info/ and filter is:
%{Connection:Client-Mac-Address-Hyphen}
In this case, check if the calling station MAC is present in Intune, because Intune uses only WiFi MAC and creates Endpoints according to WiFi MAC.
Intune as http Auth source also works when Base ULR is:
http://172.17.8.2/device/info/id/But then you have to use "Intune ID" value (not MAC), which you can take from already Extension created Endpoints. eg filter - %{Endpoint:Intune ID}:
Attributes in both scenarios are:
Also try to enable Endpoint cache in Extension configuration :
*(I also created API User for Extension, but according to manual it should not be used)
Also, check if the Extension subnet is allowed (added) to cppm Application Access Control > ClearPass API, if You are using Application Access Control.
When you add the Intune Auth source as Additional Authorization source, You should see additional info in the Access Tracker Request Detail Input and use that info for role mapping:
Hope this info could help somehow :)
Regards
------------------------------
Kestutis Virsilas
------------------------------
Original Message:
Sent: Oct 24, 2021 08:17 AM
From: Phillip Horn
Subject: ClearPass Intune Extension HTTP authentication source errors
I'm working through a similar issue.I think the v5 intune extension is different in the way it operates and you can not query it like you are doing. That is from v4.
Look at the latest guide and see the auth-n vs auth-z section.
It seems as though you can not query the intune attributes directly. Instead, you have to query Endpoint:Intune attributes. Because of this, it's not exactly real time info.
Perhaps someone with more knowledge could shed more light? I haven't got mine working yet, but I did figure that's why I kept getting http errors.
------------------------------
Phillip Horn
Original Message:
Sent: Oct 15, 2021 07:26 AM
From: Rikard Berg
Subject: ClearPass Intune Extension HTTP authentication source errors
I tried now to delete the old Authentication Source and create a new one step-by-step from the guide.
The difference now was that I got a different error: Policy server HTTP attribute query returned error=500
------------------------------
Rikard Berg
Original Message:
Sent: Oct 15, 2021 05:07 AM
From: Rikard Berg
Subject: ClearPass Intune Extension HTTP authentication source errors
Hi,
I am having some problems when trying to fetch role mappings from the Intune authentication source.
A few pictures on how it is set up. The Intune Extension is up and running with the IP address 172.17.0.2
In the Access Tracker the information computed with Intune is and it seems to fetch that from the Endpoint database:
The HTTP Authentication is set up
I have two filters, one that used to be original and one I tried to update based on the document from v5 (reference under)
Support CenterFor the service I have added the HTTP auth source as well as the Endpoint database (hence the Endpoint: Intune attributes)
I have tried to update the filters based on the documentation following Appendix A
The Alert I get in the tracker is this:
I must be doing something wrong, but I am unable to see where the issue is. Does anyone have a clue what it could be?
Troubleshooting steps:
* Restarted Extension
* Stop/Start Extension Service from Server Manager
* Verified IP address used.
* Read the documentation carefully, previously I had a different filtering and no /device/info/ based on earlier in the documentation.
The extension itself shows no errors while in debug mode and updates endpoints according to the logs.
Thanks,
------------------------------
Rikard Berg
------------------------------