Role Derivation with Mixed Authentication Sources
A hospital has 4,000 employees and 1,200 contractors. Wireless uses 802.1X with EAP-TLS for employees and PEAP-MSCHAPv2 for contractors. ClearPass Policy Manager (CPPM) is the RADIUS server, integrated with Active Directory (AD) for employees and a local SQL database for contractors. The security team wants to assign roles: Employee-Full for employees with a valid certificate and group membership 'ClinicalStaff', Employee-Limited for other employees, and Contractor for contractors. Recently, some employees with expired certificates were still granted Employee-Full because CPPM fell back to PEAP after EAP-TLS failed. Also, contractors were sometimes assigned Employee-Limited because their usernames matched an AD account. The hospital uses Aruba Mobility Controllers (MM/MD) and ClearPass. The security team wants to enforce role mapping based on authentication method, group membership, and device type (managed vs. unmanaged). They also need to ensure that contractors cannot access clinical VLANs.
1. Explain why employees with expired certificates were granted Employee-Full and how you would modify the CPPM service and role mapping to prevent this fallback, ensuring that EAP-TLS is the only method for employees.
Read the worked answer
The fallback occurred because the CPPM service allowed multiple authentication methods (EAP-TLS and PEAP) for the same service, and the enforcement policy did not differentiate between them. When EAP-TLS failed due to an expired certificate, the client fell back to PEAP, which succeeded with AD credentials. To prevent this:
- Separate services: Create two distinct CPPM services: one for employees that only allows EAP-TLS (enabled methods: EAP-TLS only) and one for contractors that only allows PEAP-MSCHAPv2. This ensures employees cannot authenticate via PEAP.
- Enforcement policy: In the employee service, add an enforcement policy that checks the authentication method (e.g., Authentication:Method equals EAP-TLS) and the certificate status (e.g., Certificate:ExpirationDate > current date). If the method is not EAP-TLS or the certificate is expired, deny access or assign a quarantine role.
- Role mapping: Map roles based on the service and AD group. For example, if service equals Employee-Service and AD group equals ClinicalStaff, assign Employee-Full; otherwise, Employee-Limited. For contractors, use a separate service and map to Contractor role.
- Certificate validation: Enable CRL/OCSP checking in CPPM to reject revoked or expired certificates during EAP-TLS.
- Client configuration: Ensure employees are configured to use only EAP-TLS and not allow fallback to PEAP (via GPO or MDM).
This approach enforces method-specific authentication and prevents fallback, ensuring that only valid certificate-based authentication grants Employee-Full.
2. Contractors were sometimes assigned Employee-Limited because their usernames matched an AD account. How would you modify the role mapping to ensure contractors are always assigned the Contractor role, and what additional enforcement would you apply to prevent access to clinical VLANs?
Read the worked answer
The issue arises because CPPM role mapping may evaluate AD group membership even for contractor authentications if the contractor's username exists in AD. To fix this:
- Service separation: As above, use separate services for employees and contractors. In the contractor service, set the authentication source to the local SQL database only, not AD. This prevents AD lookups for contractors.
- Role mapping order: In CPPM, role mapping rules are evaluated top-down. Place a rule at the top: if service equals Contractor-Service, assign Contractor role, and stop processing further rules. This ensures contractors never fall through to AD-based rules.
- Enforcement policy: For the Contractor role, apply enforcement that assigns a contractor VLAN (e.g., VLAN 200) and a downloadable ACL that denies access to clinical subnets (e.g., 10.10.0.0/16). Use Aruba controller role-based ACLs to restrict traffic.
- Device profiling: Optionally, use CPPM device profiling to identify managed devices; contractors with unmanaged devices could be further restricted (e.g., captive portal).
- Monitoring: Audit logs to detect any contractor assigned to non-contractor roles and alert.
By isolating authentication sources and prioritizing service-based role mapping, contractors are consistently assigned the Contractor role and restricted from clinical VLANs via VLAN assignment and ACLs.