Security

last person joined: yesterday 

Forum to discuss Enterprise security using HPE Aruba Networking NAC solutions (ClearPass), Introspect, VIA, 360 Security Exchange, Extensions, and Policy Enforcement Firewall (PEF).
Back to discussions
Expand all | Collapse all

ClearPass and External DB issue when used for Authentication

This thread has been viewed 6 times

  • 1.  ClearPass and External DB issue when used for Authentication

    Posted Dec 18, 2018 08:02 AM

    Hello,

    I'm trying to do a configuration to authenticate some guests against a PostGRE DB and other against Guest User Repository.
    The Captive Portal process works fine for the Guest Users but for the other, I can't achieve to perform the authentication.

    Here is some information:

    - PostGRE DB contains username and password (in clear-text)

    - If I configure the external DB to be used for authorization, I can retrieve required fields, so, the connection to the DB is correct

    - My query is quite simple: SELECT CAST(password as VARCHAR(12)) AS User_Password FROM mytable WHERE UPPER(uid) = UPPER('%{Authentication:Username}');  (I'm casting the value to be sure it is in string format)

     

    Depending of the Pre-Auth check of the Captive Portal, I have the following error:

    - Application: Failed to execute sql, reason=The server does not support SSL.

    - RADIUS: MSCHAP: Authentication failed

    - None (I would like to avoid as the user experience is bad in case of failed login): CHAP: Clear text password not available

     

    I found this tuto which doesn't help me: https://community.arubanetworks.com/t5/AAA-NAC-Guest-Access-BYOD/How-To-Setup-External-SQL-Filter-Queries-for-Authentication-in/ta-p/187252

     

    Are there some configuration I need to do to use the External DB as authentication source which I don't need for authorization?

    According to this: http://deployingradius.com/documents/protocols/compatibility.html , Clear-text can be used at least for the MS-CHAP used in RADIUS Pre-auth and then in the CHAP for the RADIUS Auth.

     

    Thank you for the help,



  • 2.  RE: ClearPass and External DB issue when used for Authentication
    Best Answer

    Posted Dec 18, 2018 04:13 PM

    As I found a solution, I answer myself :)

     

    The issue was the setting of the Password Type in the Connection Details of the DB Source.  It was set on MD5.

     

    For whose who are searching more info:

     https://www.youtube.com/watch?v=C24PLuIP5vo

    https://www.youtube.com/watch?v=399TXYhsvRU

     

    RTFM