Security

Hello all,

I've read al lot in the community post, but can't find (or get the right idea for) the answer.

I have two different Active Directories. There both are standalone and not connected in a trust or something else. 

Domain 1  contoso.com -  is used productive 

Domain 2 edu.contoso.com - is only used for eduroam  authentication

Now my goal is to create two different services in Clearpass so that I can use each of the two Active Directories for different SSID1 eduroam SSID2 contoso_staff with EAP-TLS.
So far, I have read that for EAP-TLS, Clearpass must be included in the domain.

But since I now have different domains, the question is how can this be solved?

Best regards

Michael

Hi Michael

For EAP-TLS ClearPass doesn't need to be domain joined. This is only true for EAP-PEAP.

ClearPass servers can join multiple Active Directories at the same time without any problems if there is a need to do so.

In your case you should create two LDAP connections, one to each AD, and use them as authentication sources in the respective services.

Hello all,

I've read al lot in the community post, but can't find (or get the right idea for) the answer.

I have two different Active Directories. There both are standalone and not connected in a trust or something else. 

Domain 1  contoso.com -  is used productive 

Domain 2 edu.contoso.com - is only used for eduroam  authentication

Now my goal is to create two different services in Clearpass so that I can use each of the two Active Directories for different SSID1 eduroam SSID2 contoso_staff with EAP-TLS.
So far, I have read that for EAP-TLS, Clearpass must be included in the domain.

But since I now have different domains, the question is how can this be solved?

Best regards

Michael

Hi Jonas,

thank you very much. I tried it but allways get the answer that the user isn't found....

So I have to dig deeper.

Thank you very much!

Hi Michael

For EAP-TLS ClearPass doesn't need to be domain joined. This is only true for EAP-PEAP.

ClearPass servers can join multiple Active Directories at the same time without any problems if there is a need to do so.

In your case you should create two LDAP connections, one to each AD, and use them as authentication sources in the respective services.

Hello all,

I've read al lot in the community post, but can't find (or get the right idea for) the answer.

I have two different Active Directories. There both are standalone and not connected in a trust or something else. 

Domain 1  contoso.com -  is used productive 

Domain 2 edu.contoso.com - is only used for eduroam  authentication

Now my goal is to create two different services in Clearpass so that I can use each of the two Active Directories for different SSID1 eduroam SSID2 contoso_staff with EAP-TLS.
So far, I have read that for EAP-TLS, Clearpass must be included in the domain.

But since I now have different domains, the question is how can this be solved?

Best regards

Michael

If you can't find the users it's probably because the default query for the username only search for the user in the sAMAccountName attribute in Active Directory:

(&(sAMAccountName=%{Authentication:Username})(objectClass=user))

I the username provided is in another form like domain\username, username@domain.com or a UPN is provided in the form of firstname.lastname@domain.com the user will not be found.

Modify the AD source under the Attributes tab

Replace the original query with:

(&(|(userPrincipalName=%{Authentication:Username}@domain.com)(sAMAccountName=%{Authentication:Username})(userPrincipalName=%{Authentication:Username}))(objectClass=user))

This query will search for the user in both the sAMAccountName and UPN attributes of the users and handle formats like:

• username
• firstname.lastname
• firstname.lastname@domain.com

To also handle domain\username you have to strip the domain part of the username in the service under the Authentication tab

Hi Jonas,

thank you very much. I tried it but allways get the answer that the user isn't found....

So I have to dig deeper.

Thank you very much!

Hi Michael

For EAP-TLS ClearPass doesn't need to be domain joined. This is only true for EAP-PEAP.

ClearPass servers can join multiple Active Directories at the same time without any problems if there is a need to do so.

In your case you should create two LDAP connections, one to each AD, and use them as authentication sources in the respective services.

Hello all,

I've read al lot in the community post, but can't find (or get the right idea for) the answer.

I have two different Active Directories. There both are standalone and not connected in a trust or something else. 

Domain 1  contoso.com -  is used productive 

Domain 2 edu.contoso.com - is only used for eduroam  authentication

Now my goal is to create two different services in Clearpass so that I can use each of the two Active Directories for different SSID1 eduroam SSID2 contoso_staff with EAP-TLS.
So far, I have read that for EAP-TLS, Clearpass must be included in the domain.

But since I now have different domains, the question is how can this be solved?

Best regards

Michael

If you can't find the users it's probably because the default query for the username only search for the user in the sAMAccountName attribute in Active Directory:

(&(sAMAccountName=%{Authentication:Username})(objectClass=user))

I the username provided is in another form like domain\username, username@domain.com or a UPN is provided in the form of firstname.lastname@domain.com the user will not be found.

Modify the AD source under the Attributes tab

Replace the original query with:

(&(|(userPrincipalName=%{Authentication:Username}@domain.com)(sAMAccountName=%{Authentication:Username})(userPrincipalName=%{Authentication:Username}))(objectClass=user))

This query will search for the user in both the sAMAccountName and UPN attributes of the users and handle formats like:

• username
• firstname.lastname
• firstname.lastname@domain.com

To also handle domain\username you have to strip the domain part of the username in the service under the Authentication tab

Hi Jonas,

thank you very much. I tried it but allways get the answer that the user isn't found....

So I have to dig deeper.

Thank you very much!

Hi Michael

For EAP-TLS ClearPass doesn't need to be domain joined. This is only true for EAP-PEAP.

ClearPass servers can join multiple Active Directories at the same time without any problems if there is a need to do so.

In your case you should create two LDAP connections, one to each AD, and use them as authentication sources in the respective services.

Hello all,

I've read al lot in the community post, but can't find (or get the right idea for) the answer.

I have two different Active Directories. There both are standalone and not connected in a trust or something else. 

Domain 1  contoso.com -  is used productive 

Domain 2 edu.contoso.com - is only used for eduroam  authentication

Now my goal is to create two different services in Clearpass so that I can use each of the two Active Directories for different SSID1 eduroam SSID2 contoso_staff with EAP-TLS.
So far, I have read that for EAP-TLS, Clearpass must be included in the domain.

But since I now have different domains, the question is how can this be solved?

Best regards

Michael