cancel
Showing results forĀ 
Search instead forĀ 
Did you mean:Ā 

Can't select user groups in authentication mapping

Can't select user groups in authentication mapping

JohanHendrikx
Contributor II
In the EAC you can configure the authentication rules in the AAA section. in one of those rules (Management Login) I want to configure an user group .

According to the help file ,should this be possible.

User/MAC/Host
Select the Pattern radio button and enter the username, MAC address, or hostname that the end-system must match for this mapping. Or, select the Group radio button and select a user group or end-system group from the drop-down list. If you enter a MAC address, you can use a colon (:) or a dash (-) as an address delimiter, but not a period (.).

The only groups I can select are End-System Groups.

How can I select an user groups ?

95f5949fad57431fbb3f3437aa290353_d5b4e711-4d8a-419c-85fb-53efacc30081.jpg



95f5949fad57431fbb3f3437aa290353_58a38fc5-77fb-4725-a854-5348873a063c.jpg

Johan Hendrik System Architect Audax
1 ACCEPTED SOLUTION

Ryan_Yacobucci
Extreme Employee
The switch might be allowing you in just because the Access was "Accept". Can you change the "Denied Access NAC profile" and set it to "Reject authentication requests".

It will be the option at the top of the profile.

Thanks
-Ryan

View solution in original post

7 REPLIES 7

JohanHendrikx
Contributor II
I've made roles and tested a connection to a swtich and a connection to an EWC controller.

Both systems have the same EAC controlers.

When connecting to the EWC with wrong credentials , the connection is refused.
When I do the test to a switch I can loging and have user rights.

Did I forgot something?
Johan Hendrik System Architect Audax

Ryan_Yacobucci
Extreme Employee
Hello Johan,

LDAP usergroups can only be used in the AAA with authentication type "Registration (Auth&Admin)".

Are you looking to send management authentications to a different authentication server based on LDAP group membership, or prevent access based on group membership?

If you're looking to prevent access based on LDAP membership the way you would do that is create a rule in the rules engine with LDAP usergroup that had an accept with appropriate management access AVPs, and below this rule create another rule for all management requests to would deny.

That way unless you're part of the LDAP group configured in the first rule you'll fall into a deny role.

Let me know if this is what you're looking for.

Thanks
-Ryan

JohanHendrikx
Contributor II
Extra information: I cann't select LDAP user groups that are created.
Johan Hendrik System Architect Audax
GTM-P2G8KFN