Security

Hello,

We are looking to give users access to ClearPass Guest so that they can manage their devices. Originally we set this up so that people would login at /guest . This works ok but then we noticed that our logo on that page links to another page called 'Unified Visitor Management':

/guest/main_intranet.php

We'd quite like to use this instead as the landing page for our users (unless there's reason not to?), but we would want to edit it (just some changes to text, and if possible change the form it uses to create a device). But I can't find where I can edit this page, can anyone help please?!

Thank you,

Guy

The best UX would be to create a DNS CNAME for something like mydevices.myorg.com and then redirect to the device page.

Better yet:

- Use the API and do a portal that doesn't suck.

Nearly everything in the portal can be customized. What "sucks"? 

Let's just say that it's the same exact portal that was available +7 years ago with Amigopod.

How can something designed more than 7 years ago can be great today? Do you realize how much style and technologies have changes in between?

Good luck fixing those tables and making it responsive and modern. Even the "new" Galleria version lacks in design and easy of use, and doesn't seem to fit the regular portals.

Building our own interface was plan A, but for reasons I won't go into here this isn't happening (yet) so we are going with the built-in interface for now...

"The best UX would be to create a DNS CNAME for something like mydevices.myorg.com and then redirect to the device page."

Hello,

Yes we will definitely use a CNAME or similar to make the URL nicer.

When you say the 'device page' which page are you talking about? There seem to be a few possibilities here. As I say the initial plan was to link to /guest (with a nicer URL) but the 'Unified Visitor Management' page seems like a (slightly) nicer landing page so the idea was to use an edited version of this. But I don't really know what this page is, what purpose is it supposed to serve? If it's really not designed to do what we want (and we can't edit it) then we can look at a different solution. At the end of the day we just want something that looks as nice as possible (within the restrictions) for end users registering BYOD devices.

Is this device registration (headless/IoT) or Onboard?

Morning,

Just headless/IoT devices

/mac_index.php seems to be a very similar page and is linked to from /guest, that would be fine to use... but again I can't find the page to edit it

If it turns out we really can't use the Unified Visitor Management page, or the /mac_index.php page (because we can't get to them to edit them) then we would need to be able to edit mac_list.php (which is where /guest goes to) to remove the links to those other pages.

I'm confused, what are you trying to edit? 

You can make the device list the default page for certain groups of users.

Apologies, let me try to explain better.

In short - we want to allow users to register and manage their devices (no cert onboarding necessary), we don't mind which page we use for that but we want to be able to edit the page (just some simple changes to links). There seem to be a number of options/interlinked pages, none of which I can work out how to edit!

At the moment visiting /guest gives non-admins (decided by AD group), the Device Registration sso-role. They are redirected to /guest/mac_list.php. I've attached a screenshot. I think this is set in Guest -> Administration -> Operator Logins -> Profiles  'Device Registration'. That's where we are at the moment. The issues are that on this page there are links from our logo (top left) and the 'Home' item in the breadcrumbs menu that take users to a page called 'Unified Visitor Management'. And another issue is that clicking 'Devices' in the lefthand menu takes you to /guest/mac_index.php.

It's these links that are the problem because they take you to pages that we can't edit (or I can't find how to edit). If we could edit these pages then they would probably be quite useful (in fact we would probably use either of them as the landing page for people visiting /guest (assuming that is possible).

So the question is how can we edit these pages? And if we can't edit either the Unified Visitor or /guest/mac_index.php pages then how can we remove the links to them from the /guest/mac_list.php page? (We would also need to remove those links from the 'create' and 'edit' device pages).

It feels like pulling at spaghetti!

I never tried to press the logo and the headers, but I see what you mean, and giving users access to pages that have fields that you can't customize looks undesired to me.

Same as you, I could not find a way to edit the 'logo link' or the pages you mentioned. Could you please open a case with Aruba Support?

Feel free to share the case number in a personal message (or mail if you have my address), so I can jump in to explain the issue.

Thanks Herman,

With a bit of help from our Aruba contact we found that we could change the heading on the Unified Visitor Management page (Guest -> Administration -> Plugins -> Kernel (of course?!!!)) which at least means we can brand it as we want.

This will probably do for us at the moment.

We did find that it's possible to remove 'Home' from breadcrumbs (in the skin settings) and also could have edited the footer for each form to remove any links ('Back to main') to the Unified Visitor Management page. That would have left us with just our logo linking to it - we could have removed the logo from the header and added it into a different part of the page without a link, but it felt like it would be a lot of changes to keep track of, and we were never going to find a very neat solution, so in the end we've gone with it rather than trying to fight it! Hopefully we'll produce our own interface at some point.

In any case I'll open a TAC case - it would be good to know if anything can be done

Love your videos by the way! Much watched here in the office!

Thanks

Guy

Case number 5348709657