Skip to main content
rstuart
rstuart
New Member
August 23, 2016
Question

User Groups (RSSO) - RADIUS Attribute Value. How to match on parts of the contents?

  • August 23, 2016
  • 2 replies
  • 5709 views

I'm using Aruba ClearPass to send accounting records to a FortiGate by sending the Roles of the authenticated user - this all works.  However, this information contains multiple entries:

 

FG800C-264 $ diag rsso query ip 172.27.0.12 Receive IPC query for vd 0:root.  Using vd server 0:root [size="1"]DB 0 find [ep='John' pg='Allowed-Device, School-Operations-Role, School-Programs-Role, [User Authenticated]' ip='172.27.0.12'] match[/size] Endpoint: John [size="1"]    RSSO Key: [style="background-color: #ffff00;"]Allowed-Device, School-Operations-Role, School-Programs-Role, [User Authenticated][/style][/size]     IP Addresses:         IP: 172.27.0.12, Time left (hh:mm:ss): 07:59:59 ** [size="1"]DB 0 find all [ep='John' pg='n/a' ip=''] match[/size] [size="1"]vd=0 Query reply ip[172.27.0.12] ep[] prof[][/size] Querying IP '172.27.0.12'

 

I need to create a User Group RSSO that will match on the RADIUS Attribute Value if it contains "School-Programs-Role".  I don't care about the other information.  If I just specify School-Programs-Role, it doesn't match - seems to be an exact match only.  Is there a way to do this?

 

Thanks!

2 replies

rstuart
rstuartAuthor
New Member
August 24, 2016

According to TAC, this is not possible.  There's no mechanism in the OS currently (5.2.8) to parse the contents of the received data - such as a regex expression.

xsilver_FTNT
Staff
xsilver_FTNT
Staff
August 29, 2016

correct, there is no partial string or regex match possible, but full string comparison only.

If your chosen AVP do contain more than expected value, due to its variability nature, then it might be better to choose or create different AVP and do match on/against that artificial one, which will always contain what you have set exactly into it.

Check RADIUS server accounting policies if it can inherit or add certain AVP per authenticated user group or so. That will help you to divide users better and more automatically.

Terms & ConditionsAccessibility statement