topic RE: NAC ldap integation - userPricipalName in Network Architecture & Design

NAC ldap integation - userPricipalName

Christoph — Thu, 12 Dec 2013 17:36:00 GMT

We would like to integrate NAC in a Wireless network and want to authenticate users against an Active Directory. The customers users know only their "userPricipalName" (UPN).

If we use the "userPricipalName" as "User Search Attribute" in the LDAP configuration from NAC (version 5.0), we don't get a RADIUS accept. We assume that the NAC is cutting the @ from the UPN. If this is the case there cannot come off a match with the UPN.
Can somebody confirm this behaviour?

And if this is the case, is there a workaround available?

Kind regrads
Christoph

RE: NAC ldap integation - userPricipalName

Brian_Anderson3 — Thu, 12 Dec 2013 20:26:00 GMT

You should be able to leave the User Search Attribute at samAccountName and still be able to use the UPN for authentication (just tested it). Do you have user to auth mapping set to catch the@UPN pattern? Pattern should be at least *@domain.name where domain.name is what is after the @ sign when you login.

RE: NAC ldap integation - userPricipalName

Christoph — Thu, 12 Dec 2013 20:45:00 GMT

Hello Brian,

thanks for your answer.
In our case UPN and sAMAccountName have nothing in common, e.g.:
samAccountName = ABC123
UPN = max@example.de
If we follow your suggestion the NAC will check "max" against the samAccountName. This will not result in a match.

And yes we have configured a pattern *@example.de to redirect the user authentication against the LDAP server.

Kind regrads
Christoph

RE: NAC ldap integation - userPricipalName

Brian_Anderson3 — Fri, 13 Dec 2013 01:24:00 GMT

Is there a reason to have those two fields different?

Somebody with knowledge of the inner workings of NAC would have to weigh in to see if that User Search field is really customizable.

A possible work around, would be to do Radius Proxy. Would be good to test and might give you a temporary solution, if the User Search field ends up being a feature request.

Regards,

Brian

RE: NAC ldap integation - userPricipalName

Tamera_Rousseau — Fri, 13 Dec 2013 01:24:00 GMT

Hi Brian, I have sent this into our NAC group so we should have some enlightenment shortly!

RE: NAC ldap integation - userPricipalName

Christoph — Fri, 13 Dec 2013 15:21:00 GMT

I don't no for sure why the AD was set up like this, I think it's the result of some former migrations. Nevertheless, we have no influence and cannot change these fields for several thousand users.

Proxy RADIUS will be a suboptimal solution because we also want to match against other AD attributes. But if there is no other way we will do it...

Kind regrads
Christoph

RE: NAC ldap integation - userPricipalName

Gregory_Hayden — Mon, 16 Dec 2013 23:49:00 GMT

Hello Christoph,

In answer to your original post, you are correct that NAC always strips off the Domain when doing an LDAP lookup on a user. Unfortunately, there is no current means by which to change this behavior. This could be put forward as a Feature Request for possible future functionality; however, I do not have an immediate means by which to work-around this behavior in an LDAP configuration.

If you do wish to raise this as a Feature Request, this can be started with opening a Services Case by either calling into the GTAC, or via the Case Management Web Portal. If you would submit the request in the Services Case, we can then take it over to a formal Feature Request for possible future functionality, and will relay it to the appropriate Product Manager for review.

Best Regards,

Gregory K. Hayden
Technical Support Specialist
Enterasys, now part of Extreme Networks
+1 603-952-6781

RE: NAC ldap integation - userPricipalName

Tamera_Rousseau — Mon, 16 Dec 2013 23:49:00 GMT

Actually, you can submit a feature request right here in the community! I can either change the type of question this is to an "Idea" for you and it will be brought into our Product Development burndown meetings, or you can create a new topic using the topic type as "Idea". This is a great way for us to determine what our customers are looking for in product features, and this gives you the ability to track its progress. Thanks for providing such a detailed answer Greg and if you have addition questions or would like to make this an Idea in our community, please let me know Christoph. Have a great day everyone!

RE: NAC ldap integation - userPricipalName

Christoph — Mon, 16 Dec 2013 23:49:00 GMT

thank you, we opened a case.

regards