Security

last person joined: yesterday 

Forum to discuss Enterprise security using HPE Aruba Networking NAC solutions (ClearPass), Introspect, VIA, 360 Security Exchange, Extensions, and Policy Enforcement Firewall (PEF).
Back to discussions
Expand all | Collapse all

radius access-accept doesnt contain username attribute

This thread has been viewed 11 times

  • 1.  radius access-accept doesnt contain username attribute

    Posted Aug 30, 2018 06:09 AM

    I'm replicating a local radius authentication with Clearpass as I do on Cisco ACS - and I have observed that with ACS the IETF:User-Name attribute is always returned in the access-accept packet.

     

    However with Clearpass this is omitted.

     

    Is this a global setting? If not how do I return the IETF:User-Name value as part of my enforcement profile?



  • 2.  RE: radius access-accept doesnt contain username attribute

    EMPLOYEE
    Posted Aug 30, 2018 08:34 AM

    ClearPass returns User-Name attribute in Access Accept packets for EAP based authentications and not for other authentication types.

     

    You can configure your enforcement as below to return the User-Name attribute.

     

    accept_enfircement.jpg

     

     



  • 3.  RE: radius access-accept doesnt contain username attribute

    Posted Aug 30, 2018 11:38 AM

    To add onto this:

     

     

    I've seen cases where Aruba controllers showed no user in the controller user tables for a subset of EAP-TTLS authenticated devices. I speculate that this is caused when a device is reauthenticated using TLS session resumption. Adding an enforcement profile that always returns the username similar to shown in the post above resolved this for us and is probably a good idea in general.

     

     



  • 4.  RE: radius access-accept doesnt contain username attribute

    EMPLOYEE
    Posted Aug 30, 2018 12:03 PM

    Most 802.1x supplicants have the ability for the user to return an anonymous username where they can enter anything.  The enforcement policy will override that.