Original Message:
Sent: Apr 22, 2025 09:02 AM
From: chulcher
Subject: clearpass active session restriction
You'll need to share more of the information from the access tracker for the first device reconnecting to have an idea of what happened, along with the logic configured to determine the number of allowed devices. The query is dependent on the accounting information being correct, you can definitely manage to get multiple devices online if you attempt to connect them all at the same time and the query is working with data that is stale.
------------------------------
Carson Hulcher, ACEX#110
Original Message:
Sent: Apr 22, 2025 03:49 AM
From: hudaya1991
Subject: clearpass active session restriction
Dear @chulcher
sorry, i mean I need it for radius authentication,
for now, i could login with these new filter, thanks,
i'm restrict just 2 device that could connect to network, and when i try to connect the third device, its successfully blocked,
but when i try to log out 1st device and waiting for 10 minutes, with 2nd device still connected, i could connect with 3rd and 1st device again to network, while 2nd device still connected to network, so for now, active session count 1st and 2nd device have same status count,
any suggestions sir ?
------------------------------
Regards,
Hudaya
ACCP, ATP, ACP-CA
Original Message:
Sent: Apr 22, 2025 02:03 AM
From: chulcher
Subject: clearpass active session restriction
Are you attempting that check for an Application or WebLogin service? That query is meant primarily to be used with a pre-auth service for validating session count during a captive portal flow. If you're attempting the check against a RADIUS auth then you'll want to use one of the other queries, either User (username is provided) or Endpoint (MAC auth for captive portal caching) depending on what stage you are in.
------------------------------
Carson Hulcher, ACEX#110
Original Message:
Sent: Apr 21, 2025 11:21 PM
From: hudaya1991
Subject: clearpass active session restriction
Dear @chulcher,
thanks for your response,
is this how you do it sir ?
and after i'm apply it as rule, i got rejected, and got message like this one
thankyou
------------------------------
Regards,
Hudaya
ACCP, ATP, ACP-CA
Original Message:
Sent: Apr 21, 2025 09:26 AM
From: chulcher
Subject: clearpass active session restriction
Those queries get added as new filters for the Insight repository. I prefer to write a role assignment that determines too many sessions are being used and then have an enforcement rule that denies access based on that role. That way I have a known and specific reason for the session to be denied rather than having to interpret what is missing from the session.
------------------------------
Carson Hulcher, ACEX#110
Original Message:
Sent: Apr 21, 2025 05:07 AM
From: hudaya1991
Subject: clearpass active session restriction
Dear @chulcher,
sorry to ask, are you add or edit this script on insight repository with your script sir ?
and are you write your rule enforcement like this one ?
------------------------------
Regards,
Hudaya
ACCP, ATP, ACP-CA
Original Message:
Sent: Nov 05, 2024 12:58 PM
From: chulcher
Subject: clearpass active session restriction
Insight is required as you'll want to count the number of current sessions and then disallow new connections based on that value. I should write this all up some day as a full solution, but here are the queries I use. Note, you'll have to enable interim accounting on the NAS with an interval of 10 minutes or less.
******
[Insight Repository]
+++++++++++++
ARUBA VERSION
New filter "Custom-ConcurrentSessions-PreAuth-User" to find concurrent sessions currently active through interim accounting updates
To be used in role mappings for Application/WebAuth where %{Authentication:Username} will exist
SELECT count(distinct calling_station_id) as active_sessions
FROM radius_acct
WHERE end_time IS null
AND username = '%{Authentication:Username}'
AND LEFT(ssid,LENGTH('%{Application:WebLoginURL:essid}')) = '%{Application:WebLoginURL:essid}'
AND updated_at > now() - interval '12 minutes'
- active_sessions: ActiveSessions-PreAuth-User, Integer
******
[Insight Repository]
+++++++++++++
ARUBA VERSION
New filter "Custom-ConcurrentSessions-User" to find concurrent sessions currently active through interim accounting updates
To be used in role mappings where %{Authentication:Username} will exist
SELECT count(distinct calling_station_id) as active_sessions
FROM radius_acct
WHERE end_time IS null
AND username = '%{Authentication:Username}'
AND ssid = '%{Connection:SSID}'
AND calling_station_id != '%{Connection:Client-Mac-Address-NoDelim}'
AND updated_at > now() - interval '12 minutes'
- active_sessions: ActiveSessions-User, Integer
******
[Insight Repository]
+++++++++++++
ARUBA VERSION
New filter "Custom-ConcurrentSessions-Endpoint" to find concurrent sessions currently active through interim accounting updates
To be used in role mappings where %{Endpoint:Username} will exist
SELECT count(distinct calling_station_id) as active_sessions
FROM radius_acct
WHERE end_time IS null
AND username = '%{Endpoint:Username}'
AND ssid = '%{Connection:SSID}'
AND calling_station_id != '%{Connection:Client-Mac-Address-NoDelim}'
AND updated_at > now() - interval '12 minutes'
- active_sessions: ActiveSessions-Endpoint, Integer
Bonus pieces: grab the simultaneous_use field from the relevant user account and figure out the remaining session time based on guest account expiration.
******
[Guest User Repository]
New filter "Custom-SimultaneousUse-User" to return the simultaneous_use attribute based on Authentication:Username
SELECT tgu.attributes ->>'simultaneous_use' AS simultaneous_use_user
FROM tips_guest_users as tgu
WHERE ((tgu.guest_type = 'USER')
AND (tgu.user_id = '%{Authentication:Username}')
AND (app_name != 'Onboard'))
- simultaneous_use_user: SimultaneousUse-User, Integer
******
[Guest User Repository]
New filter "Custom-SimultaneousUse-Endpoint" to return the simultaneous_use attribute based on Endpoint:Username
SELECT tgu.attributes ->>'simultaneous_use' AS simultaneous_use_endpoint
FROM tips_guest_users as tgu
WHERE ((tgu.guest_type = 'USER')
AND (tgu.user_id = '%{Endpoint:Username}')
AND (app_name != 'Onboard'))
- simultaneous_use_endpoint: SimultaneousUse-Endpoint, Integer
******
[Guest User Repository]
New filter "Custom-RemainingExpiration-User" to return the account expiration timestamp and time remaining until expiration for a guest account.
This accounts for Account Lifetime (expire_postlogin) when calculating the account expiration time and remaining time,
rather than reading the current value and returning blindly.
SELECT
CASE
WHEN (expire_time > CURRENT_TIMESTAMP(0)) AND ((attributes->>'expire_postlogin')::int != 0)
THEN (CURRENT_TIMESTAMP(0) + ((attributes->>'expire_postlogin')::text||' minutes')::interval)
ELSE expire_time::timestamp
END AS guest_account_expiry,
CASE
WHEN (expire_time > CURRENT_TIMESTAMP(0)) AND ((attributes->>'expire_postlogin')::int = 0)
THEN extract(epoch FROM (expire_time - CURRENT_TIMESTAMP(0)))::int
WHEN (expire_time > CURRENT_TIMESTAMP(0)) AND ((attributes->>'expire_postlogin')::int != 0)
THEN extract(epoch FROM ((CURRENT_TIMESTAMP(0) + ((attributes->>'expire_postlogin')::text||' minutes')::interval) - CURRENT_TIMESTAMP(0)))::int
ELSE 0
END AS guest_remaining_expiration
FROM tips_guest_users
WHERE ((guest_type = 'USER') AND (user_id = '%{Authentication:Username}') AND (app_name != 'Onboard'));
- guest_account_expiry: GuestAccountExpiry, Date-Time
- guest_remaining_expiration: RemainingExpiration-User, Integer
******
[Guest User Repository]
New filter "Custom-RemainingExpiration-Endpoint" to return the time remaining until expiration for a guest account based on Endpoint:Username
SELECT
CASE WHEN expire_time > now() THEN CAST(EXTRACT(epoch FROM (expire_time - NOW())) AS INTEGER)
ELSE 0
END AS remaining_expiration, expire_time::timestamp AS expire_time_endpoint
FROM tips_guest_users
WHERE ((guest_type = 'USER')
AND (user_id = '%{Endpoint:Username}')
AND (app_name != 'Onboard'))
- remaining_expiration: RemainingExpiration-Endpoint, Integer
- expire_time_endpoint: ExpireTime-Endpoint, Date-Time
------------------------------
Carson Hulcher, ACEX#110
Original Message:
Sent: Nov 05, 2024 12:20 PM
From: peter.elms
Subject: clearpass active session restriction
hi Airheads,
just wondered what the recommended way for restricting access to guest users to one device is?
i have a guest portal backed off to AD and when the user logs on with username\password i'm writing the user account to the endpoint repository
and i'd like to block access if another device tries to use the same account details
i'd like to use an enforcement profile that denies access when one more than one device is being used (one account\one device)
Do you have to use Insight or is there a simpler way?
cheers
Pete