Wireless Access

Hi, on a WiFi controller with ArubaOS 8.10, I would like to create an SSID that uses a PSK but also a Mac filter (so that only clients that know the PSK and have their Mac address whitelisted can connect). I've found articles stating

a) how to do that, with commands that don't exist in AOS 8

b) how to do that with commands that exist, but it doesn't work

c) that this is not possible with AOS 8

In all my tests, clients always ended up in whatever was defined as initial-role. Can someone answer whether what I want is possible at all?aaa profile "aaa-cp-private2-auth"
    initial-role "denyall"
    authentication-mac "mac-auth-profile"
    mac-default-role "cp-employee-authenticated"
    mac-server-group "Internal-Only"
    authentication-dot1x "default-psk"
    dot1x-server-group "srvg-cp"
    l2-auth-fail-through
!

That's just a MAC authentication applied to a WPA2-PSK network, which is the basis for setting up MPSK as well.  Using the Internal database is going to be a challenge in AOS 8 as the functionality was mostly deprecated.