Security

we change the LDAP Authentication filter to :

(&(|(sAMAccountName=%{Authentication:Username})(userPrincipalName=%{Authentication:Username}))(objectClass=user))

and it seems that it has syntax error as when filter is chosen we receive :
The specified filter query cannot be parsed.

Any thoughts what might be wrong?

I'm using the same exact filter without any issues. Check if you have attribute userPrincipalName in your LDAP schema. By default it should be there.

Best, Gorazd

------------------------------
Gorazd Kikelj
------------------------------

Hi, I normally use this one. That is the same in principle but written diferently.

(|(&(objectClass=user)(sAMAccountName=%{Authentication:Username}))

    (&(objectClass=user)(userPrincipalName=%{Authentication:Username})))

I hope this helps

2022-10-21 05:20:50,256 [Th 282 Req 462670 SessId R0000289d-01-63520201] ERROR RadiusServer.Radius - rlm_ldap: ldap_search() failed: Bad search filter: (|(&(objectClass=user)(sAMAccountName=LABPC$)) (&(objectClass=user)(userPrincipalName=LABPC$)))
2022-10-21 05:20:50,283 [Th 282 Req 462670 SessId R0000289d-01-63520201] ERROR RadiusServer.Radius - rlm_ldap: ldap_search() failed: Bad search filter: (|(&(objectClass=user)(sAMAccountName=LABPC$)) (&(objectClass=user)(userPrincipalName=LABPC$)))

This is what i get ...
Any Thoughts?
Original Message:
Sent: Oct 20, 2022 10:45 AM
From: Ulises Cazares
Subject: Clearpass LDAP The specified filter query cannot be parsed.

Hi, I normally use this one. That is the same in principle but written diferently.

(|(&(objectClass=user)(sAMAccountName=%{Authentication:Username}))

    (&(objectClass=user)(userPrincipalName=%{Authentication:Username})))

I hope this helps

That filter looks good. Works fine in my lab if I change the computer name to one that exists in my network. You could use an LDAP browser, to test that LDAP query and see if AD shows some error.

Otherwise, it may be best to get in contact with Aruba Support (through your Aruba partner) to get this issue investigated.

------------------------------
Herman Robers
------------------------
If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
------------------------------

Original Message:
Sent: Oct 20, 2022 10:31 PM
From: ioannis vosikas
Subject: Clearpass LDAP The specified filter query cannot be parsed.

2022-10-21 05:20:50,256 [Th 282 Req 462670 SessId R0000289d-01-63520201] ERROR RadiusServer.Radius - rlm_ldap: ldap_search() failed: Bad search filter: (|(&(objectClass=user)(sAMAccountName=LABPC$)) (&(objectClass=user)(userPrincipalName=LABPC$)))
2022-10-21 05:20:50,283 [Th 282 Req 462670 SessId R0000289d-01-63520201] ERROR RadiusServer.Radius - rlm_ldap: ldap_search() failed: Bad search filter: (|(&(objectClass=user)(sAMAccountName=LABPC$)) (&(objectClass=user)(userPrincipalName=LABPC$)))

This is what i get ...
Any Thoughts?

Original Message:
Sent: Oct 20, 2022 10:45 AM
From: Ulises Cazares
Subject: Clearpass LDAP The specified filter query cannot be parsed.

Hi, I normally use this one. That is the same in principle but written diferently.

(|(&(objectClass=user)(sAMAccountName=%{Authentication:Username}))

    (&(objectClass=user)(userPrincipalName=%{Authentication:Username})))

I hope this helps

I was able to reproduce this same issue on ClearPass 6.10.8, 6.11.10 and 6.12.4, but it seems an intended behavior on "Filter" tab with compound LDAP queries as seen in https://community.arubanetworks.com/discussion/eap-tls-authentication-method-setting-authorization-required, but it should work on Access Tracker requests.