Security

last person joined: yesterday 

Forum to discuss Enterprise security using HPE Aruba Networking NAC solutions (ClearPass), Introspect, VIA, 360 Security Exchange, Extensions, and Policy Enforcement Firewall (PEF).
Back to discussions
Expand all | Collapse all

eap-tls method config option ... Authorization required ....

This thread has been viewed 0 times

  • 1.  eap-tls method config option ... Authorization required ....

    Posted Sep 03, 2019 09:03 AM

    Help page says ... is there any more info as to what this actually means?

    A

     

    Authorization Required

    This parameter is enabled by default. Specify whether to perform an authorization check.



  • 2.  RE: eap-tls method config option ... Authorization required ....
    Best Answer

    EMPLOYEE
    Posted Sep 03, 2019 12:36 PM

    If enabled, the user must exist in the identity store (authentication source) before continuing on to regular authorization.



  • 3.  RE: eap-tls method config option ... Authorization required ....

    Posted Sep 04, 2019 07:03 AM

    o.k. so just to check

     

    if I have a cert with a cn of the form <userid>-1234@york,ac.uk and I can strip off everything including and after the "-"  I end up with the userid. The ocsp method is bundled with peap and ttls in a service so the auth source is AD

    So if I check the box will that mean that if <userid> isn;t in AD I'll get an access reject ?

     



  • 4.  RE: eap-tls method config option ... Authorization required ....

    EMPLOYEE
    Posted Sep 04, 2019 09:04 AM

    Username is the EAP Identity, not necessarily the cert CN.

     

    OCSP is not used with TTLS or PEAP.

     

    If the username does not exist in AD, it will be rejected, assuming authorization is enabled.



  • 5.  RE: eap-tls method config option ... Authorization required ....

    Posted Sep 04, 2019 09:25 AM

    >Username is the EAP Identity, not necessarily the cert CN.

     

    o.k.

     

    >OCSP is not used with TTLS or PEAP.

    Yup I know

     

    >If the username does not exist in AD, it will be rejected, assuming >authorization is enabled.

    o.k thanks