Integration Guide for Aruba clearpass (CPPM)

Introduction

This guide provides information on how to:

• Set up Beyond Identity as a 3rd party IdP with Aruba CPPM for Wi-Fi Access. 
• Set up Aruba Instant AP (IAP) via Aruba Central Cloud to leverage Aruba CPPM and Beyond Identity SAML based flow for MFA. (l3 Authentication)

Prerequisites

Ensure that you have the following:

1. Administrator Access on Aruba CPPM to setup custom services and web logins. 
2. Administrator Access to Aruba Central for configure Aruba Instant AP for external redirects. 
3. Beyond Identity (BI) Admin Portal Access. 
4. Devices with BI Platform Authenticator and a valid Passkey. 

SAML Connection Between BI & Aruba CCPM

 Configuration on Beyond Identity Admin Portal

1. Navigate to Integrations 🡪SAML🡪Add a SAML connection. 
2. Configure a Name for the connection. 
3. Set the value of the SP Single Sign On URL using the below format

https://<FQDN-Aruba-CCPM>/networkservices/saml2/sp/acs

4. Set the value of the SP Audience URL using the below format

https://<FQDN-Aruba-CCPM>/networkservices/saml2/sp

5. Set the remaining values as below and Save Changes

6. Note down the IdP SSO URL and download the certificate as shown below

Configuration on Aruba CPPM

1. Navigate to Administration🡪Certificates🡪Trust List🡪Add 
2. Browse the Beyond Identity Certificate downloaded in the step 6 in the previous configuration and update the Usage as SAML and Others as shown below

3. Navigate to Configuration🡪Identity🡪Single Sign-On(SSO)🡪SAML SP Configuration. 
4. Update the Identity Provider (IdP) URL with the value stored in step 6 in the previous configuration.
5. Under Enable SSO For check Insight and Guest. 
6. Under IdP Signing Certificate select the Beyond Identity Certificate stored in the Trust store. 
7. Hit Update to update the SAML settings. 

8. Navigate to Configuration🡪Pages🡪Web Logins and Create a new Web Login
   1. Provide a Name and Page Name
   2. Under Login Form🡪Pre-Auth Check: Pick SAML Service Provider

Configuration on Aruba Central for IAP SSID SETUP

1. Navigate to Devices🡪WLANS🡪Add SSID
2. Under General tab input the ESSID name. ex: BYID-TEST
3. Under the security tab configure the below attributes. 
   1. Security Level: Visitors
   2. Type: External Captive Portal
   3. Captive Portal Profile: (Create new one as shown in step 4)
   4. Primary server: Aruba CPPM FQDN

4. Create Captive Portal Profile as shown below
   1. Name: Assign the name for the profile
   2. Authentication Type: Radius Authentication
   3. IP or Hostname: Aruba CPPM hostname
   4. URL: Web Login Service Address ending in /guest/<pagename>.php
   5. Captive Portal Failure: Deny Internet
   6. Redirect URL: Any URL 

5. Under Advanced Settings enable Mac Authentication for caching the mac-address.

6. Optionally Enable Accounting and point to the Acct server. 
7. Under the Access tab set the Access rules to Unrestricted. (Role Based Access is handled by Aruba CPPM)
8. Navigate to Devices🡪Access Points🡪Security🡪Roles and Create a new role (ex: beyond-preAuth)
9. The Access rules in this newly created role should allow the following
   1. Access to Clearpass (http/https)
   2. DHCP/DNS
   3. Apple CNA (captive.apple.com)
   4. Access to Beyond Identity cloud (.byndid.com)

WOrkflow

1. Device Connects to the SSID configured for Beyond Identity for the first time. 
2. Aruba AP does MAC-Authentication using RADIUS against CPPM using the client mac address. 
3. Aruba CPPM invokes the Guest Mac Authentication service which has an enforcement profile (ex: Beyond-Guest Captive Portal Profile) that is configured to return a role name which matches the one configured in the IAP. (ex: beyond-preAuth)

4. Once the pre-auth role is assigned to the device its now connected to a captive portal at which point the IAP redirects the client to the web-login service which initiates the SAML flow with Beyond Identity. 
5. At this point the SAML SP service is invoked in CPPM (ex: Cloud SAML Clearpass Admin SSO Login service with enforcement profile  to instruct the device to perform full RADIUS auth)

6. After the SAML flow is complete the IAP is instructed to perform a full RADIUS authentication.
7. At this point the CPPM invokes a BEYOND Guest Access service (created earlier) for post auth which refers to an enforcement profile created to set the Mac address caching to a day or a month. 

SAMPLE ACCESS TRACKER View