topic Re: XIQ-SE Authentication in ExtremeCloud IQ- Site Engine Management Center

XIQ-SE Authentication

Tiago_Molinos — Mon, 08 Jan 2024 19:04:25 GMT

Hi!

I'm trying to configure a MS NPS server to act as RADIUS server authenticator for XIQ-SE login.

I've managed to do it, but whenever there's a user who has never logged in before (or that it hasn't been manually created and added to an Authorization Group) it just keeps asking for credentials and never logs in.

I know there must be some "Automatic Membership Criteria" defined, but I cannot find any examples on how to do it, specifically when using RADIUS.

I've captured the RADIUS packets and saw that I got authorized. I also saw on XIQ-SE Event log a "No Group for User" event - "Unable to find dynamic group for user XPTO using RADIUS configuration".

On the reply RADIUS packets I see that there are no VSA's sent back and that's normal because I haven't configured them as I don't know if they are required... Is this the way to go? Any documentation on what VSA to use?

Any help on achieving this?

Re: XIQ-SE Authentication

Stefan_K_ — Tue, 09 Jan 2024 08:54:55 GMT

Hi Tiago,

I did this using ExtremeControl, but it should work also for any third party radius server.

I configured a Filter-Id in the automatic Membership criteria, for example:

My ExtremeControl rule then has this filter configured:

I have some other rules that return another Filter-Id that is used for other groups.

Hope that helps a bit.

Best regards
Stefan

Re: XIQ-SE Authentication

Tiago_Molinos — Tue, 09 Jan 2024 09:25:14 GMT

I also thought something link this could be a solution. I can even use other random VSAs... I'll try to go that way and test it.

Still if there is a manufacturer recomended way to do this would be great!

Thanks Stefan!

Re: XIQ-SE Authentication

Tiago_Molinos — Tue, 09 Jan 2024 09:57:59 GMT

I've already tested using the Filter-ID and it worked perfectly!

I still don't know if this is the recomended way to do it, but it sure works as expected.

Maybe this can be a good add to the official documentation that tends to take you in a direction that will not work if you choose RADIUS as the protocol to use. If you decide to use LDAP it makes sense to use the OU=CN notation, but if you choose RADIUS that's not the way to go because the RADIUS server will not send those attributes automatically...

Thanks again Stefan!

Re: XIQ-SE Authentication

Stefan_K_ — Tue, 09 Jan 2024 10:00:41 GMT

Great to hear!

It's the recommended way, I once was in contact with GTAC regarding this topic.

Re: XIQ-SE Authentication

Ryan_Yacobucci — Tue, 09 Jan 2024 13:19:10 GMT

I can confirm this is the recommended configuration.

You can use other attributes, but the RADIUS dictionary within XIQ-SE for use with this feature is very limited. If you aren't going to use filter-id use another common standardized AVP.

Thanks
Ryan

Re: XIQ-SE Authentication

Tiago_Molinos — Tue, 09 Jan 2024 14:52:23 GMT

Good!! Nice to know!