Clearpass and IAG sync SSO

wow Lv1Posted 2024-Jul-30 13:09

user connect authentication using .1x in Aruba clearpass.
can IAG read the username and IP that has been logged into clearpass.
I've tried using radius. but the result is that users still have to log in again at IAG.
How do IAG read usernames and IPs without having to log in to IAG, but get forward usernames and IPs from clearpass.

Enrico Vanzetto has solved this question and earned 20 coins.

Posting a reply earns you 2 coins. An accepted reply earns you 20 coins and another 10 coins for replying within 10 minutes. (Expired) What is Coin?

Enter your mobile phone number and company name for better service. Go

Hi, to get Single Sign-On (SSO) working between Aruba ClearPass and Sangfor Internet Access Management (IAM), just follow these steps:

Set Up ClearPass as an Identity Provider (IdP):
First, configure Aruba ClearPass Policy Manager (CPPM) as your IdP for SSO.
Make sure ClearPass is synced with NTP (Network Time Protocol) along with other SAML Service Providers (SPs) and IdPs. If the clocks are out of sync, SAML won’t work properly.

Sync Active Directory (AD) Users to IAM:
In IAM, set up synchronization with your AD domain accounts. This will allow IAM to recognize AD users.
Once this is done, IAM can authenticate users using their domain names instead of IP addresses.

Enable API for SSO in ClearPass:
ClearPass can send information using JSON and REST API methods.
Configure ClearPass to send SSO-related data to IAM via HTTP requests.
IAM will listen for login and logout requests from third-party servers, including ClearPass.
Is this answer helpful?
rani Posted 2024-Aug-02 21:50
  
Hi
Simply follow these steps to get Aruba ClearPass and Sangfor Internet Access Management (IAM) to work with Single Sign-On (SSO):

Configure Identity Provider (IdP) ClearPass:

Set up Aruba ClearPass Policy Manager (CPPM) as your SSO identity provider first.

Ensure that ClearPass, in addition to other SAML Service Providers (SPs) and IdPs, is in sync with NTP (Network Time Protocol). If the clocks are not in sync, SAML will not function correctly.
Sync Users from Active Directory (AD) with IAM:
Configure synchronisation between your AD domain accounts and IAM. IAM will be able to identify AD users as a result.
After that, domain names rather than IP addresses can be used by IAM to authenticate users.



Enable ClearPass's SSO API:

ClearPass may send data using REST API and JSON methods.

Set up ClearPass to use HTTP requests to deliver SSO-related data to IAM.

Requests for login and logout from external servers, such as ClearPass, will be received by IAM.







Sheikh_Shani Lv2Posted 2024-Aug-01 01:01
  
Hello Dear

Set up Clearpass to communicate user names and IP addresses together with RADIUS accounting messages to IAG.
Configure IAG to accept and handle these Clearpass RADIUS accounting messages.
Verify that the User-Name and Framed-IP-Address properties are included in RADIUS packets, then set up IAG to extract and map them.
Set up Single Sign-On (SSO) in IAG to automatically log users in using the RADIUS accounting data.
Verify that users don't need to log in again after authenticating with Clearpass and are immediately logged in to IAG.
Farina Ahmed Lv5Posted 2024-Jul-31 14:01
  
This can be done by setting up ClearPass to forward RADIUS accounting messages to IAG. These messages contain the necessary user and IP information. On the IAG side, ensure it is configured to process these RADIUS accounting messages to extract and use the user and IP details for authentication purposes. This way, once a user authenticates via 802.1X on ClearPass, their credentials are automatically passed to IAG, enabling SSO without requiring additional login steps.
vesogi7900 Lv3Posted 2024-Jul-31 12:47
  
1. Configure ClearPass to send RADIUS accounting messages to IAG, including user names and IP addresses.
2. Set up IAG to receive and process these RADIUS accounting packets from ClearPass.
3. Ensure RADIUS packets include User-Name and Framed-IP-Address attributes, and configure IAG to extract and map these.
4. Configure Single Sign-On (SSO) in IAG to use the RADIUS accounting information for automatic user login.
5. Confirm that users are logged in automatically to IAG after authenticating through ClearPass without needing to log in again.

I Can Help:

Change

Moderator on This Board

1
3
6

Started Topics

Followers

Follow

Board Leaders