Users Guide

284| 802.1X Authentication Dell Networking W-Series ArubaOS 6.5.x| User Guide
l Unicast Key Rotation Time Interval: 1021 Seconds
In the WebUI
1. Navigate to the Configuration > Security > Authentication > L2 Authentication page.
2. Select 802.1X Authentication Profile, then select the name of the profile you want to configure.
3. Select the Advanced tab. Enter the following values:
n Reauthentication Interval: 6011
n Multicast Key Rotation Time Interval: 1867
n Unicast Key Rotation Time Interval: 1021
n Multicast Key Rotation: (select)
n Unicast Key Rotation: (select)
n Reauthentication: (select)
4. Click Apply.
In the CLI
(host)(config) #aaa authentication dot1x profile
reauthentication
timer reauth-period 6011
unicast-keyrotation
timer ukey-rotation-period 1021
multicast-keyrotation
timer mkey-rotation-period 1867
Application Single Sign-On Using L2 Authentication
This feature allows single sign-on (SSO) for different web-based applications using Layer 2 authentication
information. Single sign-on for web-based application uses Security Assertion Markup Language (SAML), which
happens between the web service provider and an identity provider (IDP) that the web server trusts. A request
made from the client to a web server is redirected to the IDP for authentication. If the user has already been
authenticated using L2 credentials, the IDP server already knows the authentication details and returns a SAML
response, redirecting the client browser to the web-based application. The user enters the web-based
application without needing to enter the credentials again.
Enabling application SSO using L2 network information requires configuration on the controller and on the IDP
server. The Dell ClearPass Policy Manager (CPPM) is the only IDP supported. The controller has been optimized
to work with CPPM to provide better functionality as an IDP.
Important Points to Remember
l CPPM is the only supported IDP.
l SSO occurs after 802.1X authentication. Therefore, SSO after captive portal authentication is not
supported. Roles for captive portal and SSO are mutually exclusive and, therefore, a user in the captive
portal role cannot perform SSO and vice-versa.
l SSO with VIA is not supported.
l There is a limit on the number of concurrent sessions that can be serviced at a given instant. This limit is set
at the webserver level using the web-server profile web-max-clients command. The default value is 320
for W-7000 Series and W-7200 Series controllers platforms and 25 for other controller platforms. The
maximum number of concurrent SSO sessions that can be handled is dependent on the other web services
being handled and the same time.