Security

Hi All,

We are implementing Wi-Fi authentication on ClearPass using EAP-TLS. We also plan to implement "Roles" based on the CN in the certificate. What is the best way to store CN to role mapping information. Would an external SQL DB is the best choice or some where locally on the ClearPass. We are talking about less than 1000 devices here.

Thanks,

Usually you use AD or LDAP to check validity of the account.  Then you can use member_of to group users into roles. 

If this is not viable for you, then external SQL database can be good option.

Best, Gorazd

Hi All,

We are implementing Wi-Fi authentication on ClearPass using EAP-TLS. We also plan to implement "Roles" based on the CN in the certificate. What is the best way to store CN to role mapping information. Would an external SQL DB is the best choice or some where locally on the ClearPass. We are talking about less than 1000 devices here.

Thanks,

Thanks for your answer.
AD does not seem like a viable option for two reasons

1) Not all devices are present in AD (like MaOS, Linux )

2) CN in the certificate does not directly corresponds to an AD attribute.

Usually you use AD or LDAP to check validity of the account.  Then you can use member_of to group users into roles. 

If this is not viable for you, then external SQL database can be good option.

Best, Gorazd

Hi All,

We are implementing Wi-Fi authentication on ClearPass using EAP-TLS. We also plan to implement "Roles" based on the CN in the certificate. What is the best way to store CN to role mapping information. Would an external SQL DB is the best choice or some where locally on the ClearPass. We are talking about less than 1000 devices here.

Thanks,

An external database is suboptimal. If it goes down, authentication will fail.

I'm not sure what you're trying to achieve. The CN from the certificate can be evaluated in role mapping, after which a TIPS role can be assigned. The TIPS role can then be used in enforcement.

Thanks for your answer.
AD does not seem like a viable option for two reasons

1) Not all devices are present in AD (like MaOS, Linux )

2) CN in the certificate does not directly corresponds to an AD attribute.

Usually you use AD or LDAP to check validity of the account.  Then you can use member_of to group users into roles. 

If this is not viable for you, then external SQL database can be good option.

Best, Gorazd

Hi All,

We are implementing Wi-Fi authentication on ClearPass using EAP-TLS. We also plan to implement "Roles" based on the CN in the certificate. What is the best way to store CN to role mapping information. Would an external SQL DB is the best choice or some where locally on the ClearPass. We are talking about less than 1000 devices here.

Thanks,

Static Role Mapping is a bit unflexible and hard to maintain. It's ok for small number of rules. 

Best, Gorazd

An external database is suboptimal. If it goes down, authentication will fail.

I'm not sure what you're trying to achieve. The CN from the certificate can be evaluated in role mapping, after which a TIPS role can be assigned. The TIPS role can then be used in enforcement.

Thanks for your answer.
AD does not seem like a viable option for two reasons

1) Not all devices are present in AD (like MaOS, Linux )

2) CN in the certificate does not directly corresponds to an AD attribute.

Usually you use AD or LDAP to check validity of the account.  Then you can use member_of to group users into roles. 

If this is not viable for you, then external SQL database can be good option.

Best, Gorazd

Hi All,

We are implementing Wi-Fi authentication on ClearPass using EAP-TLS. We also plan to implement "Roles" based on the CN in the certificate. What is the best way to store CN to role mapping information. Would an external SQL DB is the best choice or some where locally on the ClearPass. We are talking about less than 1000 devices here.

Thanks,

It really depends on what @dvmrp is trying to achieve.

Static role mapping is inflexible, and registering 1,000 devices in a database isn't exactly easier.
A check for CONTAINS might be enough to map the role.

Static Role Mapping is a bit unflexible and hard to maintain. It's ok for small number of rules. 

Best, Gorazd

An external database is suboptimal. If it goes down, authentication will fail.

I'm not sure what you're trying to achieve. The CN from the certificate can be evaluated in role mapping, after which a TIPS role can be assigned. The TIPS role can then be used in enforcement.

Thanks for your answer.
AD does not seem like a viable option for two reasons

1) Not all devices are present in AD (like MaOS, Linux )

2) CN in the certificate does not directly corresponds to an AD attribute.

Usually you use AD or LDAP to check validity of the account.  Then you can use member_of to group users into roles. 

If this is not viable for you, then external SQL database can be good option.

Best, Gorazd

Hi All,

We are implementing Wi-Fi authentication on ClearPass using EAP-TLS. We also plan to implement "Roles" based on the CN in the certificate. What is the best way to store CN to role mapping information. Would an external SQL DB is the best choice or some where locally on the ClearPass. We are talking about less than 1000 devices here.

Thanks,

Hi All,

We are implementing Wi-Fi authentication on ClearPass using EAP-TLS. We also plan to implement "Roles" based on the CN in the certificate. What is the best way to store CN to role mapping information. Would an external SQL DB is the best choice or some where locally on the ClearPass. We are talking about less than 1000 devices here.

Thanks,

As mentioned an external database would most likely be the best option.

In ClearPass you can't use the internal databases in this way to store your own custom data. The only database in ClearPass that potentially may be able to do this is the Guest User Repository.

If you manually creates users in the Guest User Repository with the same username as the Common name in the certificate and assign each user to a role, you may be able to use this database as an authorization source during EAP-TLS authentication and assign roles.

I have never tried anything like this myself, so I can't guarantee it will work.

Hi All,

We are implementing Wi-Fi authentication on ClearPass using EAP-TLS. We also plan to implement "Roles" based on the CN in the certificate. What is the best way to store CN to role mapping information. Would an external SQL DB is the best choice or some where locally on the ClearPass. We are talking about less than 1000 devices here.

Thanks,

There is not a pattern in CN that can be used. Some times CN corresponds to device serial numbers and other times it could be hostname. Certs are generated by a different group, so we don't have much control. The obvious choice is to use external SQL database and populating the database is easy using a python script. Being the single point of failure we will have to deploy atleast two instances of this DB. I don't want to complicate the things for this (small to med) deployment. I will explore the Guest User Repository, that's a good idea. 

As mentioned an external database would most likely be the best option.

In ClearPass you can't use the internal databases in this way to store your own custom data. The only database in ClearPass that potentially may be able to do this is the Guest User Repository.

If you manually creates users in the Guest User Repository with the same username as the Common name in the certificate and assign each user to a role, you may be able to use this database as an authorization source during EAP-TLS authentication and assign roles.

I have never tried anything like this myself, so I can't guarantee it will work.

Hi All,

We are implementing Wi-Fi authentication on ClearPass using EAP-TLS. We also plan to implement "Roles" based on the CN in the certificate. What is the best way to store CN to role mapping information. Would an external SQL DB is the best choice or some where locally on the ClearPass. We are talking about less than 1000 devices here.

Thanks,

Hi All,

We are implementing Wi-Fi authentication on ClearPass using EAP-TLS. We also plan to implement "Roles" based on the CN in the certificate. What is the best way to store CN to role mapping information. Would an external SQL DB is the best choice or some where locally on the ClearPass. We are talking about less than 1000 devices here.

Thanks,

------------------------------
NadeemNet
------------------------------

dvmrp,

See this AirHeads Broadcast video by Herman. I think it is exactly what you are looking for: Airheads Broadcast

Original Message:
Sent: Mar 16, 2026 08:11 AM
From: dvmrp
Subject: EAP-TLS to role mapping

Hi All,

We are implementing Wi-Fi authentication on ClearPass using EAP-TLS. We also plan to implement "Roles" based on the CN in the certificate. What is the best way to store CN to role mapping information. Would an external SQL DB is the best choice or some where locally on the ClearPass. We are talking about less than 1000 devices here.

Thanks,

------------------------------
NadeemNet
------------------------------

It's not exactly, but it can be used to store the Certificate CN in the endpoint database. I've created in my lab something similar based on the Certificate Serial number.

Make sure that the Endpoint database entry (MAC for the entry does not need to be the correct one) has additional attributes: Certificate-Serial (or CN in your case), role, and I have vlan as well.

Then I copied the Endpoint DB Auth Source (name: EndpointDB-vlan-role-by-certificate-serial) and query it based on the Certificate-Serial (instead of the original that uses Client MAC):

select attributes->>'role' as "role", attributes->>'vlan' as "vlan" FROM tips_endpoints WHERE attributes->>'Certificate-Serial' = '%{Certificate:Serial-Number}'

In the Enforcement Policy I do something like:

 (Tips:Role  EQUALS  Homelab) AND  (Authentication:OuterMethod  EQUALS  EAP-TLS) AND  (Authorization:EndpointDB-vlan-role-by-certificate-serial:vlan  EXISTS   ) AND  (Authorization:EndpointDB-vlan-role-by-certificate-serial:role  EXISTS   ) 	PANW-Update, EndpointDB-serial-role-vlan, Return-Full-Username 

And the Enforcement profile EndpointBD-serial-role-vlan returns:

1. 	Radius:Aruba	Aruba-User-Role	= 	%{Authorization:EndpointDB-vlan-role-by-certificate-serial:role}2. 	Radius:Aruba	Aruba-User-Vlan	= 	%{Authorization:EndpointDB-vlan-role-by-certificate-serial:vlan}

May work as well in your case and takes away the need of an external SQL database that may become a single point of failure (and additional maintenance).

Just consider this 'as inspiration', it may not work at large scale or under all circumstances; so no guarantees, nor claims that this the best/optimal/most-secure way of doing this.

------------------------------
Herman Robers
------------------------
If you have urgent issues, always contact your HPE Aruba Networking partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact HPE Aruba Networking TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or HPE Aruba Networking.

In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.

Original Message:
Sent: Mar 17, 2026 09:33 AM
From: MGT-Joe
Subject: EAP-TLS to role mapping

dvmrp,

See this AirHeads Broadcast video by Herman. I think it is exactly what you are looking for: Airheads Broadcast

Original Message:
Sent: Mar 16, 2026 08:11 AM
From: dvmrp
Subject: EAP-TLS to role mapping

Hi All,

We are implementing Wi-Fi authentication on ClearPass using EAP-TLS. We also plan to implement "Roles" based on the CN in the certificate. What is the best way to store CN to role mapping information. Would an external SQL DB is the best choice or some where locally on the ClearPass. We are talking about less than 1000 devices here.

Thanks,

------------------------------
NadeemNet
------------------------------

Hi Herman.

This is a great example. I usually use Guest Device Repository, but in some cases endpoint db looks like more elegant solution.

Best, Gorazd

It's not exactly, but it can be used to store the Certificate CN in the endpoint database. I've created in my lab something similar based on the Certificate Serial number.

Make sure that the Endpoint database entry (MAC for the entry does not need to be the correct one) has additional attributes: Certificate-Serial (or CN in your case), role, and I have vlan as well.

Then I copied the Endpoint DB Auth Source (name: EndpointDB-vlan-role-by-certificate-serial) and query it based on the Certificate-Serial (instead of the original that uses Client MAC):

select attributes->>'role' as "role", attributes->>'vlan' as "vlan" FROM tips_endpoints WHERE attributes->>'Certificate-Serial' = '%{Certificate:Serial-Number}'

In the Enforcement Policy I do something like:

 (Tips:Role  EQUALS  Homelab) AND  (Authentication:OuterMethod  EQUALS  EAP-TLS) AND  (Authorization:EndpointDB-vlan-role-by-certificate-serial:vlan  EXISTS   ) AND  (Authorization:EndpointDB-vlan-role-by-certificate-serial:role  EXISTS   ) 	PANW-Update, EndpointDB-serial-role-vlan, Return-Full-Username 

And the Enforcement profile EndpointBD-serial-role-vlan returns:

1. 	Radius:Aruba	Aruba-User-Role	= 	%{Authorization:EndpointDB-vlan-role-by-certificate-serial:role}2. 	Radius:Aruba	Aruba-User-Vlan	= 	%{Authorization:EndpointDB-vlan-role-by-certificate-serial:vlan}

May work as well in your case and takes away the need of an external SQL database that may become a single point of failure (and additional maintenance).

Just consider this 'as inspiration', it may not work at large scale or under all circumstances; so no guarantees, nor claims that this the best/optimal/most-secure way of doing this.

------------------------------
Herman Robers
------------------------
If you have urgent issues, always contact your HPE Aruba Networking partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact HPE Aruba Networking TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or HPE Aruba Networking.

In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.

Original Message:
Sent: Mar 17, 2026 09:33 AM
From: MGT-Joe
Subject: EAP-TLS to role mapping

dvmrp,

See this AirHeads Broadcast video by Herman. I think it is exactly what you are looking for: Airheads Broadcast

Original Message:
Sent: Mar 16, 2026 08:11 AM
From: dvmrp
Subject: EAP-TLS to role mapping

Hi All,

We are implementing Wi-Fi authentication on ClearPass using EAP-TLS. We also plan to implement "Roles" based on the CN in the certificate. What is the best way to store CN to role mapping information. Would an external SQL DB is the best choice or some where locally on the ClearPass. We are talking about less than 1000 devices here.

Thanks,

------------------------------
NadeemNet
------------------------------