Dell PowerConnect W-Clearpass 100 Software Guía de usuario descargar pdf (Pagina 173)

ClearPass Guest 3.9 | Deployment Guide RADIUS Services | 173

 With authorization method Assign a fixed user role:

Sending Access-Request of id 122 to 127.0.0.1 port 1812

User-Name = "demouser"

User-Password = "XXXXXXXX"

rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=122, length=27

Reply-Message = "Guest"

Note that in this case, the RADIUS attribute returned (Reply-Message) corresponds to the user role

selected.

 With authorization method Use PHP code to assign a user role (Advanced) – more complex

authorization rules can be implemented to specify which role to assign to an authenticated user.

Authorization can use any of the available properties of the user account, as well as taking into account

other factors such as the time of day, previous usage, and more.

Advanced Authorization — Example 1

This example covers the case where a domain contains several organizational units (OUs), and the users in

each OU are to be mapped to a specific RADIUS role ID.

For example, to implement the following configuration:

 OU East should be mapped to RADIUS role ID 4

 OU Central should be mapped to RADIUS role ID 5

 OU West should be mapped to RADIUS role ID 6

Make sure the following configuration is set:

1. First, ensure that the Base DN for the authentication server is set to the root of the domain – for

example: DC=server,DC=local – rather than the “users” container. This is necessary as the

organizational units are located below the top level of the directory and cannot be searched from the

CN=Users container.

2. Select the authorization method Use PHP code to assign a user role (Advanced) and use the

following code:

if (stripos($user['distinguishedname'],'OU=East')!== false) return 4;

if (stripos($user['distinguishedname'],'OU=Central')!== false) return 5;

if (stripos($user['distinguishedname'],'OU=West')!== false) return 6;

return false;

Explanation: During user authorization, the distinguished name of the user (which will contain the user’s

OU) is checked against the defined rules, and an appropriate role ID is returned. If no match is found, false

is returned, which means that authorization fails and the user’s Access-Request will be rejected.

Information on the stripos function for case-insensitive substring matching can be found at stripos().

Advanced Authorization — Example 2

This example covers the case where users are assigned group memberships, and users in a particular group

are to be mapped to a specific RADIUS role ID.

To determine the appropriate role ID, navigate to RADIUS Services> User Roles and check the ID column for the

appropriate role.

To determine the appropriate role ID, navigate to RADIUS Services> User Roles and check the ID column for the

appropriate role.

1 2 ... 168 169 170 171 172 173 174 175 176 177 178 ... 517 518

Sin comentarios

Dell PowerConnect W-Clearpass 100 Software Guía de usuario Pagina 173