topic Re: Credential Distribution Groups: Instead of Guest Management Role User, I wish to have staff users log in via AD, Active Directory User, so they can manage guests. in Aerohive Migrated Content

Credential Distribution Groups: Instead of Guest Management Role User, I wish to have staff users log in via AD, Active Directory User, so they can manage guests.

AnonymousM — Mon, 26 Nov 2018 11:29:08 GMT

Instead of Guest Management Role User, I wish to have staff users log in via AD, Active Directory User, so they can manage guests.

I have only used the Guest Management Role where individual Hivemanager accounts have been added.

The method in the help page is very brief

https://docs.aerohive.com/330000/docs/help/english/ng/Content/gui/configuration/configuring-employee-group.htm

Is there any step by step guide for adding a AD account, and using Groups from this to allow Staff Guest Managers to login and add new guests to a Usergroup?

Re: Credential Distribution Groups: Instead of Guest Management Role User, I wish to have staff users log in via AD, Active Directory User, so they can manage guests.

samantha_lynn — Mon, 26 Nov 2018 21:10:34 GMT

We do have this feature in HiveManager (where users will login with their AD credentials to the HiveManager), but it is quite new and we are still working on documentation for it. As soon as we have more documentation I will be sure to update you.

Re: Credential Distribution Groups: Instead of Guest Management Role User, I wish to have staff users log in via AD, Active Directory User, so they can manage guests.

AnonymousM — Tue, 27 Nov 2018 02:56:15 GMT

Thanks for the quick response Sam. Our customer has requested to deploy this method in Q1 2019. Do you have a timescale available? This everything ready to use, apart from documentation? Appears I just need to determine how to link their AD to their On-Premise NG VHM?

thanks,

Re: Credential Distribution Groups: Instead of Guest Management Role User, I wish to have staff users log in via AD, Active Directory User, so they can manage guests.

samantha_lynn — Tue, 27 Nov 2018 03:10:02 GMT

I don't have a time table on the technical documentation at the moment, but I'll inquire again and let you know what I find out. I'm also working on some setup guides, I hope to have those published before the new year as well.

Re: Credential Distribution Groups: Instead of Guest Management Role User, I wish to have staff users log in via AD, Active Directory User, so they can manage guests.

AnonymousM — Tue, 27 Nov 2018 03:21:18 GMT

Thanks

Re: Credential Distribution Groups: Instead of Guest Management Role User, I wish to have staff users log in via AD, Active Directory User, so they can manage guests.

pagella — Wed, 28 Nov 2018 15:45:02 GMT

Im also interested

Re: Credential Distribution Groups: Instead of Guest Management Role User, I wish to have staff users log in via AD, Active Directory User, so they can manage guests.

AnonymousM — Tue, 18 Dec 2018 16:28:29 GMT

Hi Sam, do you have an update on the documentation? perhaps a bullet point guide to get started?

Re: Credential Distribution Groups: Instead of Guest Management Role User, I wish to have staff users log in via AD, Active Directory User, so they can manage guests.

samantha_lynn — Wed, 19 Dec 2018 05:09:29 GMT

I don't have an update on the official documentation but I will check in for you and let you know. As far as the set up goes, it should be a simple as clicking on the Silhouette icon> Global Settings> RADIUS Configuration> Toggle to to ON> Choose if you would like the HiveManager Admin Authentication Settings to use Radius and local (users can log in with AD credentials or the normal HiveManager made user credentials) or just Radius> Click on the plus icon to create a new Radius tie in> Fill in the Radius information (IP, Authentication type/port, accounting port, shared secret)> Add> Save.

That said, I don't think it's working properly at the moment, and I have no technical documentation to go off of yet. I'll let you know as soon as I hear back on the status of that technical documentation. I'm very sorry for the long wait here, but I sincerely appreciate your patience and your continued attention to this thread.

Re: Credential Distribution Groups: Instead of Guest Management Role User, I wish to have staff users log in via AD, Active Directory User, so they can manage guests.

AnonymousM — Wed, 19 Dec 2018 06:35:34 GMT

Hi Sam,

Thanks for the update regarding the AD integration for Credential Groups – I do hope this can be made possible for our customer. This is the first customer to ask for this functionality. They currently operate on NG-VA 12.8.2.2

I would like to go over their overall requirement for BYOD, as it is quite unusual. What was a simple BYOD SSID for Staff and Guests looks to be gaining complexity!

They wish to have two User Profiles on a single SSID:

a) Staff for Self Registration

b) Visitors/Guests arranged by Permitted staff to provide access via Hivemanager to create PPSKs

I believe option b) above is simply tied to the AD Group allowing staff (in the AD Group) to login to HiveManager to create Guest accounts, when this feature is confirmed:
[cid:image004.jpg@01D4978E.69CCD9D0]

The details provided by AIA are taking shape as below:

[cid:image005.png@01D4978E.69CCD9D0]

The option a) could be a RADIUS SSID which reassigns the UserProfile based on Staff providing their RADIUS credentials, assigning Staff to the AIAStaff profile for their BYOD devices.

However I’m not sure if it is possible, on the same SSID to assign Visitors/Guests to authenticate via PPSK (or appropriate) to be assigned the AIAGuest profile.

On another hive, I have applied in Classic, the UserProfile re-assignment, where the default untrusted profile is from the RADIUS credentials (allows staff BYOD to join using their RADIUS), then if the machine is a domain device, they are upgraded to a trusted user profile by UserProfile classification. Perhaps this kind of concept can be applied so that only a single SSID is able to be used, however I see that classification by Domain name is not included in NG – like in Classic.

I will find out more about their scope. But in the meantime I wondered if you had any thoughts on limitations.

Thanks,
Jason

Jason Hills
Senior Engineering Consultant
Kordia Ltd | DDI. +6445505069 | M. +64212418563

Re: Credential Distribution Groups: Instead of Guest Management Role User, I wish to have staff users log in via AD, Active Directory User, so they can manage guests.

AnonymousM — Wed, 19 Dec 2018 07:55:32 GMT

Hi Sam,

Unfortunately there is no option as you describe in their NG-VA 12.8.2.2 (latest version)
the Silhouette icon> Global Settings> RADIUS Configuration> Toggle to to ON>

The only options in Global Settings are below:

[cid:image001.jpg@01D4979A.192BDDD0]

Also for Cloud hosted NG, there is no RADIUS option either.

Hopefully this is added soon as you mention.

Thanks
Jason

Jason Hills
Senior Engineering Consultant
Kordia Ltd | DDI. +6445505069 | M. +64212418563

Re: Credential Distribution Groups: Instead of Guest Management Role User, I wish to have staff users log in via AD, Active Directory User, so they can manage guests.

samantha_lynn — Wed, 19 Dec 2018 21:38:32 GMT

Hi Jason, I'm sorry for all the confusion with the Radius login feature, as you can see it's a bit of a work in progress. Once we get the feature fully functional and documented, if you still have issues with the feature we can work from there.

As for the set up you mentioned, it is not possible to have one SSID use both Radius and PPSK. We can do client classification to move certain users to different user profiles within the same SSID, but the SSID authentication method has to be one thing; Radius or PPSK or PSK or Open.

Also you mentioned "Staff for Self Registration", did you mean you want your staff to self register or that you want staff to approve self registration guest users?

Finally, when you mentioned "Visitors/Guests arranged by Permitted staff to provide access via Hivemanager to create PPSKs", that sounds like self registration for guests with employee approval. We can make Guest Manager users that can log in to HiveManager and only have access to the user tab to create new users, is that what you are looking for?

Re: Credential Distribution Groups: Instead of Guest Management Role User, I wish to have staff users log in via AD, Active Directory User, so they can manage guests.

AnonymousM — Thu, 20 Dec 2018 02:59:53 GMT

Yep understand the SSID is either RADIUS or PPSK etc.

Staff are intended to use their RADIUS credentials to sign in their BYOD client devices - by self-registration. This should be easy with a CWP to external RADIUS.

Visitors are intended to be provided access by nominated staff. The nominated staff will sign in to Hivemanager as a Guest Manager (User tab) using their AD credentials (instead of HM guest login). These staff will belong to an AD Group that allows access to HM. It is not Visitor self-reg with employee approval by email notification.

Hopefully you are able to get the RADIUS log in to HM feature arranged - Geoff Mason mentioned it is possible in NG-VA, but not in NG-Cloud?

thanks.

Re: Credential Distribution Groups: Instead of Guest Management Role User, I wish to have staff users log in via AD, Active Directory User, so they can manage guests.

samantha_lynn — Thu, 27 Dec 2018 04:23:44 GMT

I'm sorry for the long wait here, I was able to confirm that the Radius log in to HiveManager feature is still not working correctly. The SAML login method works, but the AD/LDAP method is still having issues.

Re: Credential Distribution Groups: Instead of Guest Management Role User, I wish to have staff users log in via AD, Active Directory User, so they can manage guests.

AnonymousM — Thu, 27 Dec 2018 11:20:25 GMT

Hi

Is the saml method the usual single sign on, email credential created from a hive manager login such as a guest manager account?

Will you be able to find an ETA ?

Thanks
Jason

Jason Hills
04 550 5069
Sent from my phone

Re: Credential Distribution Groups: Instead of Guest Management Role User, I wish to have staff users log in via AD, Active Directory User, so they can manage guests.

samantha_lynn — Thu, 03 Jan 2019 03:44:25 GMT

That would depend heavily on the integration, it can be SSO, or it can include other factors. I would recommend opening a case so you can discuss your specific network set up with a technician to see what we would be able to do for you there. Integrating SAML will require a technical support case anyway as this isn't enabled by default in HiveManager, we'd need to enable it for you.

As for the ETA, I've confirmed again today that this is still an issue. I think if you can open a case for this as well, it would help our engineering team to have access to new data to continue working on this issue. Ultimately, the first announcement of a fix for this issue will be in the release notes for an on premises HiveManager Update. So the next update would be the earliest we'd see this fixed, and it's not guaranteed that we'd have a fix then as it's still an open issue on our side currently. Just to set expectations here a bit.

Re: Credential Distribution Groups: Instead of Guest Management Role User, I wish to have staff users log in via AD, Active Directory User, so they can manage guests.

AnonymousM — Tue, 22 Jan 2019 11:03:55 GMT

Hi Sam,

I’m aware that documentation is not quite ready for the RADIUS Hivemanager login. I am pleased that I was able to login as a Super-Admin on their Onpremise Hive and could follow your instructions to Silhouette icon> Global Settings> RADIUS Configuration> Toggle to to ON>
And have created the links to their radius servers.

I understand that I now need to:

· have the customer include a value in their AD for those users with the rights to login to the VHM.

· And also to have their RADIUS servers trust the IP of the OnPremise NGVA.

· Then to create the CDGroup with this value.

Do you have any instructions on these steps, or confirmation that any issues are now resolved?

Thanks,
Jason

Jason Hills
Senior Engineering Consultant
Kordia Ltd | DDI. +6445505069 | M. +64212418563

Re: Credential Distribution Groups: Instead of Guest Management Role User, I wish to have staff users log in via AD, Active Directory User, so they can manage guests.

samantha_lynn — Tue, 22 Jan 2019 21:25:39 GMT

Unfortunately the issues won't be resolved without an on premises update, which hasn't happened since the problem was first reported. I can't promise the very next release will have the fix included as I haven't seen release notes for any upcoming versions yet, but any patch for this issue will have to come through an update to the HiveManager version.

As for the next steps you outlined, the first one unfortunately isn't something I have visibility on since that's on the AD side, but I would imagine you would create the users as normal.

The second step, "And also to have their RADIUS servers trust the IP of the OnPremise NGVA", are you referring to the NAS list within the Radius server? That already trusts all Aerohive devices by default so you wouldn't need to edit that list unless you wanted to use non-Aerohive devices to use this Radius server as well (not something we'd recommend).

The last step, "Then to create the CDGroup with this value", I'm fairly sure that needs to be a new account in the Account Management section rather than the CDGroups, but I will confirm this for you just to be certain.

Re: Credential Distribution Groups: Instead of Guest Management Role User, I wish to have staff users log in via AD, Active Directory User, so they can manage guests.

AnonymousM — Mon, 18 Feb 2019 05:09:33 GMT

Hi Sam,

Do you have any update on the ETA for releasing radius authentication to allow staff accs to sign on to a guest manager admin role in credential distribution group.

I understand this is also possible with SAML. I do not have experience with this however.
I can pursue this further with our customer but I need to know what they require.

What systems do they need to integrate their AD to Hivemanager?
Is this ADFS?
I will request a support case to be opened as I understand that SAML is not available without being enabled via ATAC.

Perhaps we could go down the SAML route if it is possible with the current lastest NGVA they run.

Thanks
Jason

Jason Hills
04 550 5069
Sent from my phone

Re: Credential Distribution Groups: Instead of Guest Management Role User, I wish to have staff users log in via AD, Active Directory User, so they can manage guests.

samantha_lynn — Thu, 21 Feb 2019 04:49:30 GMT

Hi Jason, sorry for the wait, I had to check in on this for you. I can confirm the fix for the current issue with Radius login for HiveManager admins should come out with the next on premises HiveManager release, which is scheduled to come out in the near future.

Re: Credential Distribution Groups: Instead of Guest Management Role User, I wish to have staff users log in via AD, Active Directory User, so they can manage guests.

george_margarit — Sat, 13 Jul 2019 00:27:55 GMT

Hello Sam,

has there been any progress on Guest Manager login to Hivemanager (on prem) via AD group?

Thanks