Security

last person joined: 20 hours ago 

Forum to discuss Enterprise security using HPE Aruba Networking NAC solutions (ClearPass), Introspect, VIA, 360 Security Exchange, Extensions, and Policy Enforcement Firewall (PEF).
Back to discussions
Expand all | Collapse all

Auto Sign-On with ClearPass and ADFS

This thread has been viewed 5 times

  • 1.  Auto Sign-On with ClearPass and ADFS

    Posted Feb 26, 2018 09:50 AM

    Hello everyone,

     

    A custumer wants to do ASO with ClearPass and ADFS.

     

    Example : a employee goes to a captive portal and logs in. Then, when he goes to an web application ASO compatible (SharePoint for example), he's automatically logged in. 

     

    I read the technote about SAML Configuration, but i'm not sure to understand how it works. I've never worked on that. 

     

    https://support.arubanetworks.com/Documentation/tabid/77/DMXModule/512/Command/Core_Download/Default.aspx?EntryId=24992 

     

     

    If i'm right, ClearPass would be the Service Provider (SP) and ADFS would be the Identity Provider (IdP).  After a succesful 802.1X authentication, un token is generated by ClearPass and sent to the controller. 

     

    When the user goes to the application, he is redirected to the IdP URL to do a SAML request. The controller intercepts the request and inserts the token and forward it to the SAML IdP. 

     

    Then the IdP checks the token. If it's valid, it sends a SAML assertion in the response to the user.

     

     

    My question is : how the IdP can check the validity of the token ? 

     

    Thank you for your help

     



  • 2.  RE: Auto Sign-On with ClearPass and ADFS

    EMPLOYEE
    Posted Feb 26, 2018 09:53 AM
    For ASO, ClearPass is both the IdP and SP and you’d need to use SAML chaining to use a secondary IdP.


  • 3.  RE: Auto Sign-On with ClearPass and ADFS

    Posted Feb 26, 2018 10:39 AM

    Thank's for your quick reply !

     

    Is there any documentation which can help to understand how to implement it ? 



  • 4.  RE: Auto Sign-On with ClearPass and ADFS

    EMPLOYEE
    Posted Feb 26, 2018 10:48 AM
    Unfortunately we don’t have documentation for every identity provider. There are too many of them.


  • 5.  RE: Auto Sign-On with ClearPass and ADFS

    EMPLOYEE
    Posted Feb 27, 2018 02:49 AM

    Hi Tim,

     

    I'm interested in this subject too.

    Can you just explain the SAML chaining part?

     

    The idea would be to chain authentication request from Clearpass to ADFS? would it be done through a service?

     

    I found your doc on Cloud Identity providers, would it be the same kind of process?

     

    Thanks