No, at the end I have not opened a TAC case as I decided to use the Aruba method for Aruba APs (no CoA) and I check the role ID in the Guest Device repository instead of endpoint repository. Occasionally I still see this behaviour but not too often. I did not have too good experience with Aruba TAC. It is not like Cisco's TAC.
Original Message:
Sent: Mar 14, 2025 05:53 PM
From: jpurpura
Subject: Clearpass Webauth sometimes cannot get GuestUser Namespace values
Did you or TAC find a solution to this problem? We are seeing the same thing in our environment with 6.11.10. In the instances where it works correctly, you can see it open the DB in the logs before returning GuestUserSPtr:
ExtDB.DBHandle - Creating DB Connection with DRIVER=PostgreSQL;SERVER=localhost;PORT=0;DATABASE=tipsdb
But when it fails to look it up, it doesn't look like it attempts to open the DB at all and just returns NULL for GuestUserSPtr.
Original Message:
Sent: Jan 28, 2025 09:41 AM
From: Istvan Hegedus
Subject: Clearpass Webauth sometimes cannot get GuestUser Namespace values
Hi,
I have 6.11.9 and have not yet opened TAC case, but I will.
Thanks
Istvan
Original Message:
Sent: Jan 28, 2025 09:36 AM
From: chulcher
Subject: Clearpass Webauth sometimes cannot get GuestUser Namespace values
What version are you running and have you opened a case with TAC?
------------------------------
Carson Hulcher, ACEX#110
Original Message:
Sent: Jan 28, 2025 04:06 AM
From: Istvan Hegedus
Subject: Clearpass Webauth sometimes cannot get GuestUser Namespace values
Hi,
I have a strange behaviour that I have seen years ago in older ClearPass versions too (e.g. 6.7) and it still bugs me.
My customer wants a MAC based device self-registration for guest access. They have Cisco and Aruba APs both, so I am using the CoA method with redirect URL for both. Using a modified copy of the mac_create form.
After the MAC self-registration the Webauth happens but sometimes in the output result the Endpoint:Guest Role ID and Endpoint:Username does not get the proper values just the name of the variables %{GuestUser:Role ID} and {%GuestUser:Visitor Name}. When that happens also the Expire-Time-Update:GuestUser value is %{GuestUser:expire_postologin} and the Expiry-Check:Expiry-Action gets only the name of the variable %{GuestUser:do_expire} instead of the real value. See screenshot.
In that case the Endpoint attributes are incorrectly filled and also when the account expires the automatic delete does not happen.
When I check the log of this Webauth I can see the following issue
2025-01-28 05:35:18,206 [RequestHandler-1-0x7f30345e5700 r=psauto-1736165716-242 h=447 r=W00000065-01-67985e86] INFO Common.GuestUserTable - Returning NULL (GuestUserPtr) for user Id d2-40-92-7c-4e-9c
In case of some clients this however does not happen and the Webauth can insert the proper values and the Common.GuestUserTable returns a GuestUserPtr.
2025-01-28 05:10:28,415 [RequestHandler-1-0x7fc2793ec700 r=psauto-1731924224-821047 h=447 r=W00000425-02-679858b4] INFO Common.GuestUserTable - Returning GuestUserSPtr for user Id c6-82-21-43-ab-66
Has anyone encountered similar issues? Does anyone know why is this happening? It seems like during the login the GuestUser Namespace is not available?
Thanks
Istvan