Sangfor Community»Categories Products Internet Access Gateway (IAG) Clearpass and IAG sync SSO

Clearpass and IAG sync SSO

views: 1426 | comments: 5 | added to Favorites 0
Lights on | 提示:支持键盘翻页<-左 右->
    组图打开中,请稍候......
wow
Created: 2024-Jul-30 13:09

Summary:

user connect authentication using .1x in Aruba clearpass. can IAG read the username and IP that has been logged into clearpass. I've tried using radius. but the result is that users still have to log ...

Reply

rani Posted 2024-Aug-02 21:50
Hi
Simply follow these steps to get Aruba ClearPass and Sangfor Internet Access Management (IAM) to work with Single Sign-On (SSO):

Configure Identity Provider (IdP) ClearPass:

Set up Aruba ClearPass Policy Manager (CPPM) as your SSO identity provider first.

Ensure that ClearPass, in addition to other SAML Service Providers (SPs) and IdPs, is in sync with NTP (Network Time Protocol). If the clocks are not in sync, SAML will not function correctly.
Sync Users from Active Directory (AD) with IAM:
Configure synchronisation between your AD domain accounts and IAM. IAM will be able to identify AD users as a result.
After that, domain names rather than IP addresses can be used by IAM to authenticate users.



Enable ClearPass's SSO API:

ClearPass may send data using REST API and JSON methods.

Set up ClearPass to use HTTP requests to deliver SSO-related data to IAM.

Requests for login and logout from external servers, such as ClearPass, will be received by IAM.







Sheikh_Shani Posted 2024-Aug-01 01:01
Hello Dear

Set up Clearpass to communicate user names and IP addresses together with RADIUS accounting messages to IAG.
Configure IAG to accept and handle these Clearpass RADIUS accounting messages.
Verify that the User-Name and Framed-IP-Address properties are included in RADIUS packets, then set up IAG to extract and map them.
Set up Single Sign-On (SSO) in IAG to automatically log users in using the RADIUS accounting data.
Verify that users don't need to log in again after authenticating with Clearpass and are immediately logged in to IAG.
Enrico Vanzetto Posted 2024-Jul-31 22:20
Hi, to get Single Sign-On (SSO) working between Aruba ClearPass and Sangfor Internet Access Management (IAM), just follow these steps:

Set Up ClearPass as an Identity Provider (IdP):
First, configure Aruba ClearPass Policy Manager (CPPM) as your IdP for SSO.
Make sure ClearPass is synced with NTP (Network Time Protocol) along with other SAML Service Providers (SPs) and IdPs. If the clocks are out of sync, SAML won’t work properly.

Sync Active Directory (AD) Users to IAM:
In IAM, set up synchronization with your AD domain accounts. This will allow IAM to recognize AD users.
Once this is done, IAM can authenticate users using their domain names instead of IP addresses.

Enable API for SSO in ClearPass:
ClearPass can send information using JSON and REST API methods.
Configure ClearPass to send SSO-related data to IAM via HTTP requests.
IAM will listen for login and logout requests from third-party servers, including ClearPass.
Farina Ahmed Posted 2024-Jul-31 14:01
This can be done by setting up ClearPass to forward RADIUS accounting messages to IAG. These messages contain the necessary user and IP information. On the IAG side, ensure it is configured to process these RADIUS accounting messages to extract and use the user and IP details for authentication purposes. This way, once a user authenticates via 802.1X on ClearPass, their credentials are automatically passed to IAG, enabling SSO without requiring additional login steps.
vesogi7900 Posted 2024-Jul-31 12:47
1. Configure ClearPass to send RADIUS accounting messages to IAG, including user names and IP addresses.
2. Set up IAG to receive and process these RADIUS accounting packets from ClearPass.
3. Ensure RADIUS packets include User-Name and Framed-IP-Address attributes, and configure IAG to extract and map these.
4. Configure Single Sign-On (SSO) in IAG to use the RADIUS accounting information for automatic user login.
5. Confirm that users are logged in automatically to IAG after authenticating through ClearPass without needing to log in again.