Security

I'm in the process of setting up a Clearpass Policy Manager server for our wireless infrastructure and I'm stuck on the configuration of the AD Source, particualarly since in our AD infrastructure we use BOTH sAMAccountName and userPrincipalName.

I was able to get it working with userPrincipalName by going into Sources -> My AD Server -> Attributes -> Authentication -> Edit/Modify -> Filter Query:

(&(objectClass=user)(userPrincipalName=%{Authentication:Username}))

However how do I change this filter query to support both searches for sAMAccountName and userPrincipalName?

Thanks

Is your UPN just your sAMAccountName@domain.xyz ?

No, they are completely different

For example, they are setup as 'first.last@domain.com' and sam is 'flast'

Try this filter:

(|(&(objectClass=user)(sAMAccountName=%{Authentication:Username}))(&(objectClass=user)(userPrincipalName=%{Authentication:Username})))

Thanks Tim that did it!

This post helped a lot. If anyone should need it:

When you strip the domainname with "user:@,\:user" in your services, you can change the query to add it again, allowing users to login with both sAMAccountName & userPrincipalName in the form of an email address:

(|(&(objectClass=user)(sAMAccountName=%{Authentication:Username}))(&(objectClass=user)(userPrincipalName=%{Authentication:Username}@yourdomainname.com)))