topic Re: Extreme Control AAA LDAP without AD Domain Join in ExtremeCloud IQ- Site Engine Management Center

Extreme Control AAA LDAP without AD Domain Join

Anonymous — Wed, 09 Oct 2019 16:15:21 GMT

Hi,

When creating AAA LDAP configuration in control the requirements for the account needed are detailed here:

https://extremeportal.force.com/ExtrArticleDetail?an=000090980

I have a couple of circumstances where EAP-TLS is being deployed and the use of NTLM authentication isn't required, just simple certificate authentication and then LDAP lookup for authorisation once in the NAC rule engine.

In that scenario when creating the LDAP configuration any account is capable of doing an AD lookup, so a domain privilege account isn't required, nor is it required for Control to join the domain.

My question is; is there an option to just create the LDAP connector with simple privileges that will do the task?

Maybe there is a specific set way to configured this in XMC, perhaps the process is exactly the same just using the a normal service account as opposed to using a domain privilege account?

Just wanted to validate what is the right way to do it, and that I am not missing anything?

Thanks in advance

Re: Extreme Control AAA LDAP without AD Domain Join

Ryan_Yacobucci — Wed, 09 Oct 2019 21:01:45 GMT

Hello Martin,

The process would be exactly the same but you are not required to have elevated privileges for the administrator username for the LDAP account specified. The account would only be used for LDAP lookups in an EAP-TLS environment.

The LDAP configuration section of the Extreme Control does double duty in that it not only provides information for the LDAP lookup but in the case that NTLM is enabled the LDAP configuration is used to fill out the smb.conf files for Samba to join the active directory.

Since NTLM isn't enabled no SMB.conf files will be generated and no domain join will be attempted. With no join being attempted we don't need a username that requires the necessary permissions to join the domain.

As long as the account can perform LDAP lookups that is all that you would need.

Thanks
-Ryan

Re: Extreme Control AAA LDAP without AD Domain Join

Anonymous — Wed, 09 Oct 2019 21:26:42 GMT

Brilliant, thanks Ryan. Been wanting to clear up that question for ages 🙂

Much appreciated for the quick response.