topic Re: How can you get PPSK passwords from an external source (e.g., RADIUS, LDAP, SQL)? in Aerohive Migrated Content

How can you get PPSK passwords from an external source (e.g., RADIUS, LDAP, SQL)?

dan_mellem — Thu, 26 Apr 2018 01:56:43 GMT

I've set up PPSK SSIDs with local users, but would like to pull password dynamically from an external source. If I select "Use GuestManager for PSK validation" it gives me an option to select a RADIUS server and User Group. I've created a user in RADIUS that matches a local user in that group but that doesn't seem to work. Is this the right approach, or how can we add and update PPSK passwords without needing to push a new config?

Thanks.

Re: How can you get PPSK passwords from an external source (e.g., RADIUS, LDAP, SQL)?

samantha_lynn — Tue, 01 May 2018 00:13:42 GMT

If you are using PPSK, then the users will be stored on the HiveManager, the AP, or the cloud (depending on a few different things like if you're using IDM, HiveManager Classic, HiveManager NG, etc). If you want to pull users from an external source, that would be a Radius set up. We can either set this up as a Radius server on an AP and link that to an external database you have set up (AD, LDAP, etc), or we can link to an existing Radius server that you have set up.

If you search in Hive Community for "Radius" and filter to only see articles, we have a few guides that can help you get this set up, or at least show you what is involved. If you have a specific set up in mind, I can help you through this post as well.

Re: How can you get PPSK passwords from an external source (e.g., RADIUS, LDAP, SQL)?

dan_mellem — Tue, 01 May 2018 01:41:16 GMT

Hi, Sam,

Thanks for your answer. We already use radius for our employee accounts but want to have a PPSK network with changing passwords for other uses (such as mobile labs). I can change the password manually and push them to the APs, but there's a lot of documentation about using GuestManager to verify credentials from a RADIUS server as needed. We don't have or need the functionality of the GuestManager package to populate the RADIUS database, but still want to use the RADIUS PPSK option. The ultimate goal is to programmatically update PPSK passwords without having to push them to the APs, and we already are updating RADIUS and LDAP, so using one of those would be preferable.

Thanks,
-Dan

Re: How can you get PPSK passwords from an external source (e.g., RADIUS, LDAP, SQL)?

samantha_lynn — Tue, 01 May 2018 03:00:30 GMT

Are you using HiveManager Classic (myhive.aerohive.com) or HiveManager NG (cloud.aerohive.com)? I'm asking because the answer will change based on the type of HiveManager you are using.

Re: How can you get PPSK passwords from an external source (e.g., RADIUS, LDAP, SQL)?

dan_mellem — Tue, 01 May 2018 03:15:47 GMT

Classic on-premise.

Re: How can you get PPSK passwords from an external source (e.g., RADIUS, LDAP, SQL)?

samantha_lynn — Tue, 01 May 2018 03:39:16 GMT

Thank you. Guest Manager is no longer supported, it reached end of life in 2016 (https://www.aerohive.com/support/end-of-life-products/). It was replaced with ID Manager, which does give you more PPSK options (such as making credentials that are only valid for a certain time period, or only valid for so long after creation or so long after first log in, etc). To use ID Manager (IDM), you will need a myhive account and separate licensing.

Re: How can you get PPSK passwords from an external source (e.g., RADIUS, LDAP, SQL)?

dan_mellem — Tue, 01 May 2018 05:27:16 GMT

Thanks. I'm aware Guest Manager is EOS but I don't need or want a management system like that (or ID Manager).

When you create a new PPSK SSID and select RADIUS authentication, you can select a server and a local user group (as opposed to a RADIUS user/group), but I'm trying to figure out how to get that last part working.

Re: How can you get PPSK passwords from an external source (e.g., RADIUS, LDAP, SQL)?

dsouri — Wed, 02 May 2018 05:26:29 GMT

Hi Dan,

IDM did use a RADSEC proxy, but the function it served was to authenticate PPSK credentials from AP to the external IDM server. That is the closest PPSK Authentication comes to using RADIUS.

Could you explain/screenshot where you are having trouble?

From what I observed in my lab instance of Classic On premise, at the SSID level, the authentication type we choose is mutually exclusive, in that it can only be one of the possible types. WPA2-PSK, WEP, PPSK, or RADIUS.

Additionally, once PPSK is selected, Local Users and Local User Groups are required.

From the PPSK documentation available on the community, I can not find anything that indicates using an external directory for PPSK Users/Groups.

https://thehivecommunity.aerohive.com/s/global-search/PPSK

Please advise if this was helpful, if you have further questions, or if there is anything I could do to assist.

Happy to help,

David

Re: How can you get PPSK passwords from an external source (e.g., RADIUS, LDAP, SQL)?

dan_mellem — Wed, 02 May 2018 07:04:03 GMT

Hi David,

Unfortunately I'm out of town and likely won't be able to attach a screenshot until Monday. Thanks for your answer and I'll try to respond as soon as I'm able.

-Dan