AAA, NAC, Guest Access & BYOD

How does ClearPass determine the domain the client belong to during MSCHAP authentication?

For dot1x authentication EAP-PEAP with MSCHAPv2 or MSCHAP authentication, Clearpass will need to be joined to the AD domain allowing it to post and read the MSCHAP reply from AD. 

I am sure we all will have a question in mind on how CPPM is able to determine which domain a client belongs to before posting the MSCHAP query?

For dot1x or MSCHAP authentication, CPPM will first search for the user in the authentication sources mapped to the service. You can also confirm from the access-tracker logs as shown below:

2017-01-20 12:25:21,859    [Th 6 Req 962567 SessId R000df961-06-5882560e] INFO RadiusServer.Radius - rlm_ldap: searching for user a*****z in AD:admmmgc.mmm.com
2017-01-20 12:25:21,859    [Th 6 Req 962567 SessId R000df961-06-5882560e] DEBUG RadiusServer.Radius - radius_xlat: Running registered xlat function of module authsrc_3029 for string 'Username'
2017-01-20 12:25:21,859    [Th 6 Req 962567 SessId R000df961-06-5882560e] DEBUG RadiusServer.Radius - rlm_ldap: - ldap_xlat
2017-01-20 12:25:21,859    [Th 6 Req 962567 SessId R000df961-06-5882560e] DEBUG RadiusServer.Radius - radius_xlat: '(&(sAMAccountName=a*****z)(objectClass=user))'
2017-01-20 12:25:21,859    [Th 6 Req 962567 SessId R000df961-06-5882560e] DEBUG RadiusServer.Radius - radius_xlat: 'dc=mmm,dc=com'
2017-01-20 12:25:21,859    [Th 6 Req 962567 SessId R000df961-06-5882560e] DEBUG RadiusServer.Radius - rlm_ldap: ldap_get_conn: Checking Id: 0
2017-01-20 12:25:21,859    [Th 6 Req 962567 SessId R000df961-06-5882560e] DEBUG RadiusServer.Radius - rlm_ldap: ldap_get_conn: Got Id: 0
2017-01-20 12:25:21,859    [Th 6 Req 962567 SessId R000df961-06-5882560e] DEBUG RadiusServer.Radius - rlm_ldap: Allocated referral parameters dn = a*****z@mmm.com & password
2017-01-20 12:25:21,859    [Th 6 Req 962567 SessId R000df961-06-5882560e] DEBUG RadiusServer.Radius - rlm_ldap: performing search in dc=mmm,dc=com, with filter (&(sAMAccountName=a*****z)(objectClass=user))
2017-01-20 12:25:21,861    [Th 6 Req 962567 SessId R000df961-06-5882560e] DEBUG RadiusServer.Radius - rlm_ldap: Setting Ldap-UserDn = CN=a*****z,OU=Users,OU=MN-Woodbury-Hartford,OU=US,DC=usac,DC=mmm,DC=com
2017-01-20 12:25:21,861    [Th 6 Req 962567 SessId R000df961-06-5882560e] INFO RadiusServer.Radius - rlm_ldap: found user a*****zin AD:admmmgc.mmm.com
2017-01-20 12:25:21,861    [Th 6 Req 962567 SessId R000df961-06-5882560e] DEBUG RadiusServer.Radius - rlm_ldap: Setting Alternate-Auth-Type = authsrc_3029
2017-01-20 12:25:21,861    [Th 6 Req 962567 SessId R000df961-06-5882560e] DEBUG RadiusServer.Radius - rlm_ldap: Setting Authentication-Source = AD:admmmgc.mmm.com
2017-01-20 12:25:21,861    [Th 6 Req 962567 SessId R000df961-06-5882560e] DEBUG RadiusServer.Radius - rlm_ldap: Setting Authentication-Source-Name = 3M_AD_test
2017-01-20 12:25:21,861    [Th 6 Req 962567 SessId R000df961-06-5882560e] DEBUG RadiusServer.Radius - rlm_ldap: Setting Authentication-Source-Id = 3029
2017-01-20 12:25:21,861    [Th 6 Req 962567 SessId R000df961-06-5882560e] DEBUG RadiusServer.Radius - rlm_ldap: Setting MS-CHAP-Use-NTLM-Auth = Yes
2017-01-20 12:25:21,861    [Th 6 Req 962567 SessId R000df961-06-5882560e] DEBUG RadiusServer.Radius - rlm_ldap: Setting NetBIOS-Name = MMM
2017-01-20 12:25:21,861    [Th 6 Req 962567 SessId R000df961-06-5882560e] DEBUG StatsDClient.StatsClient - Formatted StatsD data=QA.us-nacsub-qa02.radius.auth.3M_AD_test.lookup-time:2|ms
2017-01-20 12:25:21,862    [Th 6 Req 962567 SessId R000df961-06-5882560e] DEBUG StatsDClient.StatsClient - Sending StatsD request=QA.us-nacsub-qa02.radius.auth.3M_AD_test.lookup-time:2|ms
2017-01-20 12:25:21,862    [Th 6 Req 962567 SessId R000df961-06-5882560e] INFO RadiusServer.Radius - LDAP/AD User lookup time = 2 ms

1st Priority: Now once the user is found from a particular authentication source. The first preference is given to the domain part which is provided with the username if any. [For example abc@mmm.com or mmm\abc] 

2nd Priority: If there isn't any domain specified with the username during authentication, next CPPM will try to take the NetBios name of the authentication source from where the user was found in the previous step.

3rd Priority: In cases where domain is not specified with the username and if CPPM is unable to determine the NetBIOS name from Authentication source [typically in case of Global Catalog Servers, where we have domains and multiple Subdomain] ClearPass will determine the domain using ObjectSID [Security Identifier]attribute which is fetched during initial search.

In scenario's where global catalog servers are used we add CPPM to domain which has trust relation to all the sub-domains and ClearPass will update its samba file with the domainSID attribute as shown below.

[domain_AD]
netbios_name = AD
realm_name = AD.ABC.EDU
domain_fqdn = u****v.ad.abc.edu
winbindd_path = /var/avenda/tips/samba/samba_AD/winbindd_privileged
trusted_domains = UCPSYCH,UCITECSS,UCSURGERY,LAW,AF,UCADS,COMDO,UCLOUD
domain_status = online
alt_name = AD.UC.EDU
domain_sid = S-1-5-21-1757981266-1383384898-725345543
num_trusted_domains = 8
trusted_domain_1 = UCPSYCH,UCPSYCH.UC.EDU,S-1-5-21-1550507792-4200741791-2288126077
trusted_domain_2 = UCITECSS,UCITECSS.UC.EDU,S-1-5-21-1454471165-1326574676-682003330
trusted_domain_3 = UCSURGERY,UCSURGERY.UC.EDU,S-1-5-21-1177238915-1645522239-839522115
trusted_domain_4 = LAW,LAW.AD.UC.EDU,S-1-5-21-1220945662-117609710-725345543
trusted_domain_5 = AF,AF.UC.EDU,S-1-5-21-619124731-2240474253-3705693027
trusted_domain_6 = UCADS,UCADS.UC.EDU,S-1-5-21-2094061547-3365754199-909415149
trusted_domain_7 = COMDO,MEDUC.EDU,S-1-5-21-1060284298-1708537768-1801674531
trusted_domain_8 = UCLOUD,UCLOUD.UC.EDU,S-1-5-21-2361349691-784785941-3894699199

The ObjectSID is a unique value used to identify the user which will look like "1.2.840.113556.1.4.146".

This attribute will be compared with the SID attribute of domain/subdomains.  An ObjectSID includes a domain prefix identifier that uniquely identifies the domain and a Relative Identifier (RID) that uniquely identifies the security principal within the domain. 

Now we could see following from the logs:

NOTE: If you enable "Always use NETBIOS name" in the Authentication >> Source, ClearPass will give NetBIOS name the first priority and override the priority.