
ClearPass Guest 3.9 | Deployment Guide Guest Management | 289
UI: Hidden field
Field Required: optional
Validator: IsValidMacAddress
Add or enable mac_auth_pair
UI: Hidden field
Initial Value: -1
Any other expiration options, role choice, surveys and so on can be entered as usual.
You will see an entry under both List Accounts and List Devices. Each should have a View Pair action
that cross links the two. Note if you delete the base account, all of its pairings will also be deleted. If RFC-
3576 has been configured, all pairs will be logged out.
Accounting-Based MAC Authentication
Accounting-based MAC authentication is a way to cache the MAC used during an initial authentication so
that the device does not need to authenticate again. The visitor authenticates with their regular credentials,
using a regular Web login or some form of transparent login, and the application server registers the MAC
for future use. The device may be configured to do this automatically, or you may enter the following PHP
code.
Edit the role of your guests and add the following:
Attribute: Tmp-String-0
Value: blank
Condition: Enter condition expression...
Expression:
return
empty($user['mac_auth'])
&& NwaDynamicLoad('NwaCreateUser')
&& NwaDynamicLoad('NwaNormalizeMacAddress')
&& ($mac=NwaNormalizeMacAddress(GetAttr('Calling-Station-Id')))
&& ((!empty($user['id']) && NwaCreateUser(array(
'creator_accept_terms'=>1,
'mac'=>$mac,
'mac_auth'=>1,
'mac_auth_pair'=>$user['id'],
'create_time' => time(),
'auto_update_account'=>1)))
|| (empty($user['id']) && NwaCreateUser(array(
'creator_accept_terms'=>1,
'role_id'=>$user['role_id'],
'mac'=>$mac,
'mac_auth'=>1,
'sponsor_name'=>$user['username'],
'modify_expire_time'=>'today 17:00',
'do_expire'=>4,
'create_time' => time(),
'auto_update_account'=>1)))
)
&& 0;
Annotated Expression: the following code is an annotated explanation of how the above code works.
return
empty($user['mac_auth']) // Not already a MAC device...
&& NwaDynamicLoad('NwaCreateUser') // Required call
Comentarios a estos manuales