Security

Hi all, 

I running into a design issue, let's say I have approx 1500+ remote branches and all of them are querying CPPM for "employee" radius authentication.  Management wants to limit the access to wireless, so employees are put in an especial OU in order to be granted access to WiFi.  The issue is that those OU's are isolated locally to each office, e.g.. branchOffice_a, branchOffice_b OU and so on, that means I would have to have a role mapping for every single office.  

I would like to hear from others as how they were able to circumvent this issue. 

Thank you in advance.  

Cheers! 

Who besides your employees are in active directory?

Just employees and we have about 20K employees throughout the branches.  Management doesn't want to allow every employee with a laptop access to corp wifi, so then created OU's groups for each branch where the local IT is in charge of adding users once they obtained approval.  

Would it be possible to use OU Contains 'CN=WiFi,', if you have that as part of the OU path?

Or put the users in a Windows Group instead of (or in addition to) in a specific OU?

Just changing the discussion slightly: Assuming you are doing TLS then assuming the certificate is valid then we can authenticate the user without explicitly knowing the OU. Granted if you wanted to have more granular role control (ie Authorization) then we would need to validate the OU.

no, we are not using TLS yet.  

no they don't, but that's not a bad idea.  You meant having OU's start with CN=WiFi and then use a wild card? wonder if I can do that condition on a role mapping in CPPM?? 

Hi,

One way to deal with it could be to retrieve the user DN as an authorization attribute then match it against a specific pattern. Assuming the location OUs have some kind of repeated naming pattern.

Example:

Lets say you get this user DN from the AD authz source: "cn=Jim Smith,ou=branchOffice_a,ou=West,dc=Domain,dc=com"

Then your role mapping rule could be something along the lines of:

Authorization:AD:DistinguishedName CONTAINS "branchOffice_"

or something more precise like:

Authorization:AD:DistinguishedName MATCHES "cn=[\w\s]+,ou=branchOffice_\w,dc=Domain,dc=com"