I can help you out with this, as I have this fully setup in our environment. Aruba support is pretty trash, so I wouldn't suggest that.
Check your Extensions Network Address on both servers in the cluster:
Policy Manager -> Administration -> Server Manager -> Server Configuration -> select your server -> Service Parameters -> Select ClearPass system services.
Under Extensions, make sure you have a network setup that is not being used anywhere else. The default value is 172.17.0.1/16. The clearpass server will create an internal network (not accessible by anything) to communicate with the extensions.
When you setup/install your extension, make sure to give it a address on the 172.17.0.0/16 network (or what ever network you setup) and ensure that you do not us the IP address that was setup for the clearpass extensions address (172.17.0.1). When you set this up, make sure to use the same IP on the extension for the publisher and subscriber.
Here is my Extension Config:
Publisher - 172.17.0.2
{
"logLevel": "DEBUG",
"verifySSLCerts": true,
"azureADEndpoint": "login.microsoftonline.com",
"graphEndpoint": "graph.microsoft.com",
"tenantId": "REMOVED",
"clientId": "REMOVED",
"clientSecret": "********",
"syncPageSize": 50,
"enableSyncAll": true,
"syncAllSchedule": "30 * * * *",
"syncUpdatedOnly": true,
"syncAllOnStart": false,
"enableEndpointCache": true,
"endpointCacheTimeSeconds": 900,
"intuneAttributes": null,
"enableUserGroups": true,
"userGroupUpdateSchedule": "30 * * * *",
"bypassProxy": true,
"enableStats": true,
"statsUsername": "",
"statsPassword": "********",
"restartPolicy": "always"
}
Subscriber - 172.17.0.2:
{
"logLevel": "DEBUG",
"verifySSLCerts": true,
"azureADEndpoint": "login.microsoftonline.com",
"graphEndpoint": "graph.microsoft.com",
"tenantId": "REMOVED",
"clientId": "REMOVED",
"clientSecret": "********",
"syncPageSize": 50,
"enableSyncAll": true,
"syncAllSchedule": "0 * * * *",
"syncUpdatedOnly": true,
"syncAllOnStart": false,
"enableEndpointCache": true,
"endpointCacheTimeSeconds": 900,
"intuneAttributes": null,
"enableUserGroups": true,
"userGroupUpdateSchedule": "0 * * * *",
"bypassProxy": true,
"enableStats": false,
"statsUsername": "",
"statsPassword": "********",
"restartPolicy": "always"
}
Things to note:
The user group mapping - I have that enabled but I haven't been able to use it. It isnt a supported feature. I can see in the debug logs where is is working perfectly but I have no way to query it.
"restartPolicy": "always" - Make sure to add this. Not in the documentation but if you don't have it, the extenstion will not start when the server is rebooted and you will need to manually restart the extenstion.
syncAllSchedule - Make sure your Publisher and Subscriber is set to sync at different times. I have one system to sync at 30 mins past the hour and the other to sync on the hour.
Azure:
Go to AAD Admin center -> Applications -> App registrations -> Create an App or go to the app you created -> API permissions:
Intune: get_device_compliance : Type Application
Graph: DeviceManagementApps.Read.All: Type Application
Graph: DeviceManagementManagedDevices.PrivilegedOperations.All: Type Application
Graph: DeviceManagementManagedDevices.Read.All: Type Application
Graph: DeviceManagementManagedDevices.ReadWrite.All: Type Application (only need write permissions if you want to CSA)
Graph: Directory.Read.All: Type Application
Graph: Group.Read.All: Type Application (needed for the unsupported sync users group option)
Graph: User.Read.All: Type Application (needed for the unsupported sync users group option)
Remove the delegated permission that the user guide shows. The delegated permission will not work.
Make sure the status for all of your API permissions shows a green checkmark for admin consent.
Go to AAD Admin center -> Applications -> App registrations -> Create an App or go to the app you created -> Certificates & secrets:
You will need to create a secret here for clientSecret in the JSON config. The Value is what you want and not the actual Secret ID. Make sure you have something that will alert you to when this expires, as you do not want this randomally failing on you due to the client secret expiring.
That should get the extension working for you. I can help you with policies/auth methods/CSAs if you need - just let me know.
Also, if you need to get user groups/device groups, I can help with that as well. I use an Azure auth source to group user group information. I have the Aruba ClearPass Universal Authentication Proxy extension running against graph to grab device group information (very custom/not documented anywhere).
If all else fails, try uninstalling and reinstalling the extension.
Good luck and let me know if you have any issues!