Security

 View Only
last person joined: yesterday 

Enterprise security using ClearPass Policy Management, ClearPass Security Exchange, IntroSpect, VIA, 360 Security Exchange, Extensions and Policy Enforcement Firewall (PEF).
Expand all | Collapse all

Clearpass RADIUS Intune/Azure AD integration POC

This thread has been viewed 33 times
  • 1.  Clearpass RADIUS Intune/Azure AD integration POC

    Posted Nov 15, 2022 11:02 AM
    Hey!

    Running a POC for my company regarding clearpass and was wondering how do you guys pull user group information from Azure ad/intune. I currently have the intune extension setup and working but the attributes passed by intune are very limited. I need to be able to pull group information to assign different roles/policies.

    Is the only way to achieve this is using secure ldap to azure domain services ? Is there a simpler way to do this ? We do not want to use onboard and we use SCEPman as a CA for EAP-TLS.

    Thanks!!


  • 2.  RE: Clearpass RADIUS Intune/Azure AD integration POC

    Posted Nov 15, 2022 08:33 PM
    I have good group information from ClearPass Guest's Azure AD social integration, they show up in Endpoint:social_groups. 6.11 has some Azure AD support but also a note "Even though the current release supports fetching these attributes, it cannot be used within the enforcement profile."
    https://www.arubanetworks.com/techdocs/ClearPass/6.11/PolicyManager/Content/CPPM_UserGuide/Auth/AuthSource_Azure.htm


  • 3.  RE: Clearpass RADIUS Intune/Azure AD integration POC

    Posted Nov 16, 2022 08:35 AM
    I may have to upgrade to 6.11 to give this a shot. Looks like it can pull group information from azure, then I can assign roles ->enforcement. If I can't use it for authorization then what the heck is the point lol


  • 4.  RE: Clearpass RADIUS Intune/Azure AD integration POC

    Posted Nov 16, 2022 01:14 PM
    I upgraded to 6.11 and configured the azure authentication source, but I do not see any authorization information being pulled when I check access tracker. I created the azure APP and gave it user.read permissions. Is there anything I'm missing ? The documentation is lacking on the exact permissions needed in the azure app.


  • 5.  RE: Clearpass RADIUS Intune/Azure AD integration POC
    Best Answer

    EMPLOYEE
    Posted Nov 17, 2022 04:23 AM
    This is what I have:
    And on the note: "Even though the current release supports fetching these attributes, it cannot be used within the enforcement profile.", that does not apply to the Group membership, but to the other attributes. And that is because the default filter does only pull the Group information, but you can add the other attributes like:
    ... which will then pull these attributes and make them available for Role Mapping or Enforcement. Example:
    Both of the following Role mappings work after that change:
    Hope this helps... and I'll reach out to the documentation team to get the Azure API required permissions added.

    ------------------------------
    Herman Robers
    ------------------------
    If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

    In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
    ------------------------------



  • 6.  RE: Clearpass RADIUS Intune/Azure AD integration POC

    Posted Nov 17, 2022 11:58 AM
    Added the group.read.all and I'm able to pull group information now nice!!! I was also stripping the user name with filter (user:@). I removed that as well so not sure if that helped, but it is working now YES