Security

Employees are currently connecting to the company wireless with their SAM account name.. we are in the midst of changing all authentication to UPN account name.  Is there a way (in Clearpass) for authentication to use SAM and UPN?  eventually it will just be UPN but for the migration, both will be needed.

Both are valid, you just need to use the strip rule to remove it prior to authentication:

so all I have to do is enable 'Strip Username Rules' and enter "user:@,\:user"

Yes. When that is enabled, all of the following will work:

username

username@domain.com

DOMAIN\username

HOST\computer-name.domain.com

The nice thing with UPNs is you can make policy decisions based on the authenticating user's domain. This is how eduroam works at its core. You can either do seperate services for each domain or just reference the "Authentication:Full-Username" attribute in a role map or enforcement policy.

didnt work.. do I need to configure something else?

What is ClearPass showing on the alerts tab in access tracker?

OK. You'll need to modify the authentication filter to be:

(|(&(objectClass=user)(sAMAccountName=%{Authentication:Username}))(&(objectClass=user)(userPrincipalName=%{Authentication:Full-Username})))

Access tracker now says: Search failed due to bad filter

Hm. OK. Try this one:

(|(&(objectClass=user)(sAMAccountName=%{Authentication:Username}))(&(objectClass=user)(userPrincipalName=%{Authentication:Username})))

same error

Try this one.

(|(&(objectClass=user)(sAMAccountName=%{Authentica​tion:Username}))(&(objectClass=user)(userPrincipal​Name=%{Authentication:Username})))

bad filter still

One more try: 

(|(&(sAMAccountName=%{Authentication:Username})(objectClass=user))(&(userPrincipalName=%{Authentication:Username})(objectClass=user)))

bad filter still

I just tested this successfully using both username and UPN.  Confirm your cut/paste did not add any characters.

doesnt work.. I confirmed.  see attachment

Server - xxx.xxx.xxx.xxx: Search failed due to bad filter
Server - xxx.xxx.xxx.xxx: Search failed due to bad filter
MSCHAP: Authentication failed
EAP-MSCHAPv2: User authentication failure

What version of CPPM?   I confirmed again it works on my end; see attached pictures.   Attached for easier reading.

6.4.2.68288

and when I add this filter, UPN and SAM auth fails.