topic Re: Does anybody know how to use the new RADIUS authentication feature for admin users in HM on Prem 12.8.2.2? in Aerohive Migrated Content

Does anybody know how to use the new RADIUS authentication feature for admin users in HM on Prem 12.8.2.2?

aerohive_rotten — Tue, 09 Oct 2018 18:06:06 GMT

I was able to connect to my RADIUS Server and get successful authentication. However the HiveManager always returned an error on the login screen.

Is there some Attribute I have to return to HiveManager from the RADIUS Server?

Re: Does anybody know how to use the new RADIUS authentication feature for admin users in HM on Prem 12.8.2.2?

samantha_lynn — Thu, 11 Oct 2018 03:48:49 GMT

There shouldn't be an attribute that needs to match for this. We do want to make sure the HiveManager address is on the NAS list of the Radius server. Are you using a Radius server hosted on an AP or a Radius server hosted on your backend network?

Re: Does anybody know how to use the new RADIUS authentication feature for admin users in HM on Prem 12.8.2.2?

aerohive_rotten — Fri, 12 Oct 2018 14:07:31 GMT

Hi Sam,

I am using a Windows NPS Server. In the log of the RADIUS I can see successful authentication.

How does the HiveManager know if the user gets Admin or Operator privileges? With HM Classic you had to use the attributes, that's why I thought this may be the way.

Re: Does anybody know how to use the new RADIUS authentication feature for admin users in HM on Prem 12.8.2.2?

samantha_lynn — Thu, 18 Oct 2018 03:06:39 GMT

I'm sorry for the delay here, I just wanted to let you know I'm still looking in to this for you. I'll update you as soon as I know more.

Re: Does anybody know how to use the new RADIUS authentication feature for admin users in HM on Prem 12.8.2.2?

AnonymousM — Fri, 19 Oct 2018 18:15:43 GMT

Hello,

in HM Classic there are some Radius-Dict files where are these attributes are defined:

VENDOR Aerohive 26928

BEGIN-VENDOR Aerohive

# The following ATTRIBUTE and VALUE definitions are required.

ATTRIBUTE AH-HM-Admin-Group-Id 1 integer

VALUE AH-HM-Admin-Group-Id Read-Only-Admin 0

VALUE AH-HM-Admin-Group-Id Super-Admin 1

VALUE AH-HM-Admin-Group-Id Read-Write-Admin 2

# The following is an example of an admin group that you can define.

#VALUE AH-HM-Admin-Group-Id Admin-Group100 100

END-VENDOR Aerohive

I have the same problem, that i see a successfully authentication at radius server but the logon to hivemanager ist not possible.

May you can test this attributes to return it to hivemanager?

Kind regards,

Tobi

Re: Does anybody know how to use the new RADIUS authentication feature for admin users in HM on Prem 12.8.2.2?

j_cross — Mon, 22 Oct 2018 21:21:21 GMT

I see similar issues with 12.8.2.2. Unable to log in since it appears we are missing documentation on what attributes we should be passing back to hivemanager.

I have also noticed that if you choose MSCHAPv2 it still tries to authenticate to the RADIUS server as PAP.

Re: Does anybody know how to use the new RADIUS authentication feature for admin users in HM on Prem 12.8.2.2?

oliver_eve — Wed, 24 Oct 2018 20:26:22 GMT

Has anyone managed to get this to work? I see my authentication request succeed on my NPS but the logon fails into NG.

Re: Does anybody know how to use the new RADIUS authentication feature for admin users in HM on Prem 12.8.2.2?

samantha_lynn — Fri, 26 Oct 2018 02:50:19 GMT

Thanks for your patience, I've found out a bit more about this feature.

We do not process attributes assigned to users when they use Radius to log in. When you have users that are going to log in via Radius, they also need to be users that have been created in the HiveManager under Account Management in Global Settings. When you create the user in Account management, you would assign their level of permission there. Regardless of the attribute returned when they log in with their Radius credentials, they will be assigned the level of permission that you specified when you created their user account in the HiveManager.

As for the issues where the authentication method changes from MSCHAPv2, we'd need to see a mirrored port packet capture that was running when you replicate this issue. This guide will walk you through how to set up a mirrored port packet capture- https://thehivecommunity.aerohive.com/s/article/Packet-Capture-with-Mirrored-Port

If you could send that to me at communityhelp@aerohive.com, I can take a look and let you know what we find.

Re: Does anybody know how to use the new RADIUS authentication feature for admin users in HM on Prem 12.8.2.2?

AnonymousM — Tue, 30 Oct 2018 18:06:59 GMT

Hello Sam,

i will send you an PCAP to communityhelp@aerohive.com this day.

Re: Does anybody know how to use the new RADIUS authentication feature for admin users in HM on Prem 12.8.2.2?

ian_blackwood — Wed, 14 Nov 2018 14:47:31 GMT

I have similar, but during "test" when adding the RADIUS (MS NPS server) it says it was rejected even though it was okay in the NPS server logs. This means I cannot SAVE the RADIUS server settings in HiveManager.

I am trying this with mixed mode (Local DB + RADIUS) as I already have existing accounts.

Sam - to clarify - so *all* users (both local and RADIUS) should be listed in Account Management ?

What is the expected behaviour when the user exists in both local and RADIUS sources ? What happens for existing users ? What happens for new users ?

Regards,

Ian

Re: Does anybody know how to use the new RADIUS authentication feature for admin users in HM on Prem 12.8.2.2?

samantha_lynn — Wed, 14 Nov 2018 21:14:50 GMT

@Ian Blackwood , to answer your questions:

So *all* users (both local and RADIUS) should be listed in Account Management ?

This is correct, the HiveManager needs to know about the user in the HiveManager account list, both for access and so it can apply the correct permission sets within the HiveManager for the user.

*When I talk about local users in this context, I do not mean internal PPSK or RADIUS credentials that you make for your end users, I'm referring to the HiveManager logins you make for Admins, Operators, Guest Managers, etc. Just so there is no confusion.

What is the expected behaviour when the user exists in both local and RADIUS sources ?

The user would log in with their RADIUS credentials, the RADIUS server would authenticate them, if this is successful the user will be logged in to the HiveManager, the HiveManager will find that users email in it's internal list of users/admins and will apply the permission set for the user that you chose when you created the user in HiveManager.

What happens for existing users ? What happens for new users ?

You can turn on RADIUS access to the HiveManager, or you can enable both so that some users can login with their RADIUS credentials and some with their local (on the HiveManager admin list) user credentials. This way, you can have users in your AD and users that only exist in the HiveManager and not in the AD. So existing users will continue to be able to log in, and new users will login in whichever method you set up for them.

I hope this helps, I am still waiting on some more documentation on this feature. I'll update you all as soon as I know more. Thank you for your patience and questions in the mean time.

Re: Does anybody know how to use the new RADIUS authentication feature for admin users in HM on Prem 12.8.2.2?

oliver_eve — Wed, 14 Nov 2018 22:00:59 GMT

Cheers Sam,

I understand the process but it doesn't work once configured i.e Radius passes authentication on the NPS box but hivemanager errors out.

Is there an open case internally for this?

Re: Does anybody know how to use the new RADIUS authentication feature for admin users in HM on Prem 12.8.2.2?

samantha_lynn — Wed, 14 Nov 2018 22:16:02 GMT

I can't speak to other cases but I can say the issue as a whole has been raised internally and we are working on this. I would urge you to open a case yourself if you haven't already, just so you are sure to get the latest updates and information on this. I'll do my best to keep you all updated on the community, but a dedicated case will likely receive updates and help a bit faster.

Re: Does anybody know how to use the new RADIUS authentication feature for admin users in HM on Prem 12.8.2.2?

bpokrant — Tue, 27 Nov 2018 23:49:05 GMT

Hello,

Solution:

If you want to use radius users to access Hivemanager you have to specify the custom attributes.

"Attributwert" (Value): 0=RO 1=SA 2=RWA

Kind regards

Re: Does anybody know how to use the new RADIUS authentication feature for admin users in HM on Prem 12.8.2.2?

ictbackoffice — Wed, 16 Jan 2019 05:05:10 GMT

Solution: (Hivemanager 12.8.2.2-NGVASEP18

Set up radius with PAP enabled as Authentication method. (i didnt needed to set the Vendor ID as custom atribute)
Create the user in the Hivemanager. You need to use the UPN from the active directory account as e-mail address.

Re: Does anybody know how to use the new RADIUS authentication feature for admin users in HM on Prem 12.8.2.2?

oliver_eve — Fri, 18 Jan 2019 19:43:47 GMT

Hey Robbert,

I've tried this but still no luck. Any other suggestions?

Re: Does anybody know how to use the new RADIUS authentication feature for admin users in HM on Prem 12.8.2.2?

samantha_lynn — Thu, 21 Feb 2019 04:53:58 GMT

Just to keep this post updated, we've confirmed the fix for this issue is in the next HiveManager on premises update, which is scheduled to come out soon. I'll keep you updated as I find out more.

Re: Does anybody know how to use the new RADIUS authentication feature for admin users in HM on Prem 12.8.2.2?

aerohive_rotten — Tue, 28 May 2019 16:56:36 GMT

This feature now works with HiveManager 12.8.3....