I’ve recently been standing up a number of virtual Aruba ClearPass appliances to provide 802.1X RADIUS authentication for both wired and wireless clients. If you are using Windows Active Directory as an authentication source, here’s a quick trick to allow your users to authenticate using either the userPrincipalName (email address) or their samAccountName (username). In my current environment, we’re a multi-brand organization with multiple @brand.com email domains where users are more likely to know their email address than their AD username. In it’s default configuration Aruba ClearPass will only authenticate against the username (samAccountName).
Log into Aruba ClearPass and go to the Policy Manager and select Configuration -> Authentication -> Sources and select your Windows Active Directory source – see the example below;
You need to update the filters on the source such as follows.
Original ClearPass Filter Query:
(&(sAMAccountName=%{Authentication:Username})(objectClass=user))
Updated ClearPass Filter Query:
(|(&(objectClass=user)(sAMAccountName=%{Authentication:Username}))(&(objectClass=user)(userPrincipalName=%{Authentication:Username})))
And then don’t forget to Save the changes and now you should be good to go!
Cheers!
