Security

Hello,

I am currently trying to see if I can utilize the different roles in ClearPass Guest to have separate user groups. For example, would it be possible to separate [Guest] users and [Contractor] users in ClearPass Guest?

I would like to be able to have a receptionist login in ClearPass Guest for [Guest] users - who only sees [Guest] users when he clicks on 'List Accounts'. Also, a second receptionist login should only see [Contractor] users.

I know there is a view called 'guest_users' and as far as I could see it doesn't distinguish between different roles. I would have to create a copy of the 'guest_users' view which only lists [Contractor] users.

But how do I manage to tie this view to the [Contractor] receptionist?

I know the ClearPass Guest software wasn't meant to handle this kind of thing but nevertheless it would be great if there would be some kind of solution!

Thanks for your help!

cheers,

Harald

Hi Victor,

creating the different roles was the first step. That was answered in the thread you referenced.

Now I would like to be able to have different receptionist users only see their [Guest] or [Contractor] accounts - if that is possible.

cheers,

Harald

There is a way to do this.

What you need to do is tie the user login with an "operator profile" that is only allowed to create guests with a certain role if that is what you want.  For example, the contractor login would only allow guests to be created with a contractor role. You can also customize the guest creation and list forms/displays per operator login.  This requires some work and I'd recommend working with your respective Aruba SE to make this happen.  It does take a little bit of work to customize the forms in that manner.  If you just want to filter out the list accounts per login, this is a bit easier...see below.

Here is the gist...navigate to the ClearPass guest UI and hit up Administration --> operator logins --> profiles as shown below:

Either duplicate the "receptionsing and front desk" role or create a new one.  I'd recommend duplicating that role to make the template easier.  Once you do that, edit this new role and then navigate to the section shown below called Operator Filter and select "only show accounts created by this operator" - 

The trick now once you've done that is to assign this operator profile to the login so that when this user logs into Guest, he/she will get assigned this operator profile and apply the configuration as done in the above example.

To do that...on CP Guest, navigate to Administration --> operator logins --> Translation rules.  This is a list of translations from Policy Manager to the operator profiles above.  The "admin_privileges" value is a direct binding from an enforcement profile in Policy Manager.  

From the new operator profile created above, create a new translation rule or edit one in the list.  Now...on the Clearpass Policy manager side, you should have a service named something like --> Guest Operator Login.  If you don't, you can easily create one from the Configuration --> Start Here --> Aruba Application Authentication.  The application name would be "Guest".

If you do, take a look at the service and specifically, the Enforcement Policy in the service.  You will see something similar to the following. What you want to do is edit this and change it to reflect the translation rule created above tied to that user login account.  You may have to change the enforcement profile to equal the "admin_privileges" value created/modified in the translation rules on CP Guest.

The Enforcement Profiles listed above are defaults as designated in the brackets.  Feel free to test/modify these to suit your deployment.  Let us know how you make out.  This is straightforward but there are some dependencies that are needed to make this work.