When a user goes through enrolment and gets a DPSK. When they then use that DPSK each device shows up as AccountDPSK-xxxxxx for the username:

Since the user went through an enrollment, CloudPath knows the username and we can use a POLICY to return the username attribute.

1. Create a RADIUS Attribute Group that associates the RADIUS value “User-name” to the variable ${USERNAME} make sure to modify the assignment behavior to add or replace:
2. Create a POLICY that returns that attribute:
3. Apply that POLICY to the DPSK pool:

    

During the next auth of that device, the returned value of the variable ${USERNAME} will be visible in the controller:

Thanks.

1. Create the Workflow on Cloudpath and add the required Plug-Ins except the SAML authentication plug-in. We will add this plug-in after the configuration on PingIdentity (IdP) side and will publish it.

2. Copy the Workflow URL (Enrollment portal URL) from Advanced tab and keep it handy for use in later steps.

3. Go to PingIdentity Portal. Select Applications > Click on + sign to create a new SAML application for Cloudpath.

4. Enter the name of the Application, add description and choose SAML as the Application type and hit Save button.

5. At this point, it will give us three options for SAML Configuration. Use "Manually Enter" option to enter the ACS URL and the Entity ID of the Service Provider (SP) which in our case is the Cloudpath server. ACS URL and SP Entity Id configuration is given in the next step.

6. In the ACS URL option, paste the Workflow URL we copied in Step 2 and append it with /samlAssertionConsumer as shown in the following screenshot :-

6. In the Entity Id option, enter the Cloudpath URL followed by /sp as shown in the screenshot below and hit Save.

7. Next, Go to the Configuration tab of the SAML app and download the metadata. This will be used in Configuring the SAML based plug-in on Cloudpath Workflow.

8. Now go to Cloudpath and edit the Workflow you created and add a plug-in “Authenticate to a Traditional authentication server” and choose SAML.

9. Choose the IdP metadata type as XML and copy the metadata into the IdP metadata XML option.

10. Next comes the IdP Entity-Id. For this, go back to PingIdentity, under the Configuration tab where we had downloaded the metadata, we can see the “Issuer Id”. This is our IdP Entity-Id that needs to be entered in the Cloudpath IdP Entity-Id option :-

11. In the SP Entity ID option, enter the same URL as in Step 6.

12. Scroll down to SAML options and select "Exact" in the AuthN Context Comparison. This may change based on your requirement.

13. Leave all other settings as default unless you want to customize the configuration based on your requirement and publish the Workflow and test it. Following is a screenshot of the Enrollment details tab showing user successfully completed the SAML authentication of the workflow :- 

Regards,

Prerequisites:

• 802.1x SSID with Cloudpath as AAA with default ‘Radius options’
• Cloudpath 5.7 and above
• Vsz/sz 5.0 and above
• Segregate the locations using WLAN/AP group.

In SmartZone controller:

Go to > WLAN > Group 1 > Edit > Select WLANs > Toggle ‘NAS-ID’ to ‘User Defined’ then mention ‘Group1’  (Required attribute value)

In Cloudpath:

Step 1: Go to >  Configuration > Policies > RADIUS Attribute Groups > Add RADIUS Attribute Group > Under ‘VLAN ID’ mention desired VLAN

Step 2: : Go to >  Configuration > Policies > Policies > Add Policy > NAS Identifier (regex): ‘Group1’ (Mention the ‘User Defined’ value set as ‘NAS-ID’ in Vsz WLAN group)

Step 3a: If Certificate based Authentication

Go to > Certificate Authority > Manage Templates >  Certificate Template > Manage > Radius Policies > +Assign Policy ‘Group1’

Step 3b: If eDPSK based Authentication

Go to > Configuration > DPSK Pools > Manage > Radius Policies > +Assign Policy ‘Group1

I am trying to deploy the Ruckus One that connecting to the AP in our premise, and it is manageable. I also tested a few authentication from Ruckus One, like Captive portal and DPSK, PSK etc. It works fine.

But I wonder what I can do to integrate with the Cloudpath. Is there any idea can share here? So I can start testing and integrating with both systems. 

Cloudpath workflow has been setup to test integrate with the Azure authentication, but not deployed to anywhere yet. 

Regards,

Timothy

Overview: This Knowledge Base article provides instructions on how to access the Command Line Interface (CLI) of CloudPath using a terminal program like Putty or similar.

To access this CLI, you will need the service password,  which is configured during the initial installation of the VM instance, like the below example:

Procedure: Follow these steps to access the CloudPath CLI using Putty:

Step 1: Open Putty

• Launch Putty or a similar terminal program.

Step 2: Configure SSH Session

• In the Putty configuration window, enter the CloudPath's IP address in the "Host Name (or IP address)" field.
• Ensure that the "Port" is set to 8022.

Note: Use SSH on port 8022 or 22. The default SSH port number is 8022, but can be changed to port 22 on the Cloudpath Administration > System Services page, SSH Service area of the page.

Step 3: Enter Credentials

• Use cpn_service for the username.
• Enter the Service Password

You have now successfully accessed the CloudPath CLI using Putty.

Enter ? to view the list of available commands.

Tip: From the command-line configuration utility, enter the console command to access the Linux shell. From the Linux shell, enter the config command to access the command-line configuration utility.

Visit this document for a fully detailed glosary of the CloudPath's CLI.

Steps to verify on Cloudpath:

• Verify if the Radius certificate is expired.>>>Cloudpath GUI>>>Configuration>>>Radius Server
  
  
  
• Scroll down and Click on Actions: Replace Certificate
  
  
  
  *********************************************************************************
  Very Few Customer uses External CA for Radius Certificate, Validate the Root Certificate of the expired Certificate, for External CA the steps are given at the end.
• Select Generate New Certificate Automatically, if you have not imported the previous certificate from external CA.
  
  >Certificate Template: will be  selected as Server Template.
  >Server Name: will be prefilled with the previous name, make sure it stays same as earlier.
  >Years Valid: will be prefilled with the 3 Years, can be extended up to 5 Years.
  
  
  
  
  
  On Success a new certificate will be assigned to the radius server with new validity.
  ***********************************************************************************
  
  If you are using an external CA for radius certificate instead of Cloudpath Onboard CA use the Option to Generate CSR and Upload a Certificate.
  
  
•  Generate CSR (If Certificate is already there skip this part)
  
  
  
  
• Fill all the information and Click Next.
  
  
  
  
• Click on Download CSR
  
  
• Submit CSR to the CA and get a Certificate to upload in the next step.
  
  
• Fill in the fields with below details and Click Next.
  
  - Public Key (PEM)  - Upload web server certificate received by CA in PEM format
  - Chain (PEM or p7b)  - Upload Root CA  in PEM or p7b
  - Additional Chain - Upload Intermediate CA  in PEM
  - Additional Chain - Upload Intermediate CA if chain have more than 3 certificate in PEM.
  - Private Key Source - If certificate received was raised with the CSR from Cloudpath, select Certificate is based on CSR.
  - Private Key Source - If certificate received was raised without a CSR from Cloudpath, select Upload Private Key.
  - Private Key (PEM) - Upload Private key in PEM
  - Private Key Password - If private key is password protected, enter password here, if not protected ignore.
  
  
  
  
• Radius Certificate will be renewed.
  
  

Steps:

• Once DPSK is generated in the Workflow>>Click on the below marked arrow.
  
  
  
  
• Add another step to Display a Message.
  
  

• Update the HTML message with the "Standard template QR Code", as below.
  
  

  Your personal Wi-Fi Password is ${DPSK}
  <br><br>
  Use this password on any device to access your personal network. You can also scan this QR Code from your mobile device:<br><br>
  
  
  
  
  
  <div style="display: flex; justify-content: center; text-align: center;" id="qrcode"></div>
  
  
  
  
  <script>new QRCode(document.getElementById("qrcode"), "WIFI:S:WLAN-NAME;T:WPA;P:${DPSK};;");</script>
  
  

  
  
  
  Make Sure to update the BOLD part (WIFI:S:WLAN-NAME) in the HTML template with your actual SSID value and Click on Save.
  
  
  
• Once Saved, Click on the pencil icon to re-modify the Display Message.
  
  
  
  
• In the Page Source: Change to Upload HTML template and browse "Cloudpath_Template_QRCode" and click on Save.(attached below)
  
  
  
  
• Publish the Workflow.
  
  

Note: 

Rename the attachment "Cloudpath_Template_QRCode.txt" to "Cloudpath_Template_QRCode.html".

If you make changes as ‘Standard Template’ as Page Source, you will have to upload the HTML file again, always upload the file last, then save and publish.

• Test the workflow, QR code will be visible after DPSK generation, Scan the QR code to connect to the DPSK SSID.
  
  

Root Cause: The Security Assertion Markup Language (SAML) relies on precise time synchronization between the systems involved (identity provider, service provider, and user's device) to ensure the security of authentication transactions.

Resolution:

• Ensure Accurate Time Configuration:

  • Confirm that both the Cloudpath instance and the virtual server have accurate time configurations.
  • Point NTP configurations to a reliable NTP server, such as RUCKUS's public NTP server (ntp.ruckuswireless.com).

• Automatic Time Synchronization:

  • Set up automatic NTP synchronization to ensure consistent and accurate time across systems.
  • Regularly monitor NTP synchronization to detect and address any time drift issues promptly.

Follow this guide for instructions on how to configure SAML services in RUCKUS Cloudpath.

How SAML Works:

1. Request Initiation:

   • User requests access to a service.
   • Service Provider (SP) redirects the user to the Identity Provider (IdP) for authentication.

2. Authentication:

   • IdP authenticates the user by requesting credentials (e.g., username and password).
   • IdP generates a SAML assertion containing authentication information encrypted with the SP's public key and user details.

3. SAML Assertion:

   • SAML assertion includes a timestamp to ensure its freshness.
   • If the SAML assertion is too old (beyond a defined time window), the assertion is considered invalid.

4. Response to Service Provider:

   • IdP sends the SAML assertion back to the user's browser.

5. Access Granted:

   • User's browser submits the SAML assertion to the SP.
   • SP validates the assertion's authenticity and, if valid, grants access.

A vulnerability in the web-based interface of the RUCKUS Cloudpath product could allow a remote, unauthenticated attacker to execute persistent XSS and CSRF attacks against an user of the admin management interface. A successful attack, combined with a certain admin activity, could allow the attacker to gain full admin privileges on the exploited system.

What action should I take?

Updating the software to its most recent version, as detailed below, will resolve the vulnerability. Since this is a high severity vulnerability, all customers are strongly encouraged to apply the update at the earliest opportunity.

What is the impact on RUCKUS products?

The following table describes the vulnerable products and software versions and the recommended actions.

New version is available for download on all the on-premises Cloudpath, Hosted Cloudpath are already patched with the fix.

Administrator>>>System Updates>>>Download Update.

When will this RUCKUS Security Advisory be publicly posted?

RUCKUS will release the initial security advisory to customers on 10/16/2023, follow below link for the official Security Advisory.

https://support.ruckuswireless.com/security_bulletins/

For Android specific there are few limitations in Intune, which is not similar to what is being done for other Device types.

 SCEP request needs to be https instead of http.

 SCEP profile should marked with Root Certificate, on other device type Intermediate Certificate is marked.(as shown below)

Ref Article: https://learn.microsoft.com/en-us/mem/intune/protect/certificates-trusted-root#create-trusted-certificate-profiles

• Intune SCEP Profile Configuration and requirement
  
  >Configure https based SCEP url, default url is http, but https is also supported.
  >In the Root Certificate map Root certificate not Intermediate(which is the other difference between other type of SCEP profiles).
  
  

   

  Rest of the Profile (Trusted Certificates and Wifi profiles) are similar to other devices based on document.
  
  
  

We have virtual SmartZone, version is 6.1.1.0.959 and I would like to apply per-user shape and not sure how I can do it. In setting I found one place where it should be:

I tried to apply L3 Access Policy but it didn't shape traffic. 

How I can apply shape per user? 

Issue: Unable to publish the workflow.

Summary: Cloudpath general behavior on publishing the workflow. 

When a workflow snapshot publish is performed a dynamic Windows executable (.exe) file is 
produced with the current workflow URL embedded. As the Windows executable is dynamically generated 
at publish time, signing the executable is required for most versions of Windows to execute the file 
without considering it malware or the similar.

Signing a Windows .exe requires a specific code signing certificate which differs from a SSL or Web Server
certificate.  


If a custom code signing certificate is not specified within Cloudpath 
(Admin UI > Administration > System Service > Web Server > “Code Signing Certificate”)
the Windows executable will need to be signed “in the cloud” with a CommScope/Ruckus provided Code Signing Certificate.
For this to occur the Cloudpath instance requires outgoing HTTPS access to xpc.cloudpath.net:443.

For more information, please visit:
https://learn.microsoft.com/en-us/windows-hardware/drivers/dashboard/code-signing-cert-manage

Troubleshooting:

We can check the connectivity to the Cloudpath backend servers by executing the below steps in Admin UI under "Support > Diagnostics > HTTPS & LDAPS Certificate" and try reaching the xpc.cloudpath.net on port 443.

We should see the success results.

Also, we can execute the reachability test from the CLI of the Cloudpath, We need to SSH into the Cloudpath using the service account and execute the below commands to verify reachability:

# console
[cpn_service@x-oc-cloudpath02 ~]$ wget -v -O/dev/null https://xpc.cloudpath.net

Expected response should be: HTTP request sent, awaiting response... 200 OK

Another command to confirm the same:

[cpn_service@x-oc-cloudpath02 ~]$ wget -v -O- https://xpc.cloudpath.net

Expected response should be: HTTP request sent, awaiting response... 200 OK

If the connection is not establishing with the backend servers, we should be seeing the below logs in Support bundle > Jboss logs. 

ts=20230707 161432.984, lvl=SEVE, action=URL_LOADER_ERROR_SOCKET_TIMEOUT, purpose=BIND_GET_SYSTEM_UPDATES, reason=connect timed out, url=https://xpc.cloudpath.net/bind/get_system_updates.php?

ts=20230707 161432.986, lvl=INFO, action=BIND_GET_UPDATES_ERROR, reason=NetworkConnection, statusCode=-3, url=https://xpc.cloudpath.net, src=service.BindingService

Resolution:

We should have a valid reachability with the servers to be able to successfully publish the workflow and if the above troubleshooting steps are not successful then we need to look into the firewall and network related settings.

Regards,

Fazil.

Table of Contents

• Cloudpath Configuration
• JAMF Configuration
  >CONFIGURATION PROFILE
  >SCEP SETTING
  >CERTIFICATE SETTING
  >NETWORK SETTING
  

NOTE: JAMF User and user group mapping has not been covered in this module.

Cloudpath Configuration

Create a SCEP Key

In the Cloudpath admin user interface, go to Certificate Authority>>> Manage Templates, then select the Certificate Template that will be used to issue the user/device certificates to the JAMF managed devices. Click on the “Manage” icon for the certificate template.

Select the SCEP Keys tab and under SCEP Keys , click on the “Add SCEP Key” button.

In the “Create SCEP Key” page, set a display name and description for the SCEP key. Set an expiration date if required. Select “Require Challenge Password” and enter password. Leave the Configuration Information section at the default settings. Click Save.

Back in the SCEP Keys tab of the certificate template, click on the “Show” icon under SCEP Enroll URL column.

This will reveal the full SCEP Key URL. Copy the full SCEP Enroll URL to a text editor (Notepad) for later use.

Root CA and Intermediate CA Export

The Root CA will be used in a later step to create a Trusted Certificate profile in JAMF.
To export the CA certificate, go to Certificate Authority>>>Manage CAs. Expand the Root section.

In the Public Key section, click on the “Download PEM” button. This will download a Base64 encoded DER file.

Perform the same steps for the Intermediate CA certificate

Get OCSP hash from Intermediate CA, it will be used in JAMF config later.

JAMF Configuration

CONFIGURATION PROFILES
Login into JAMF select Configuration Profiles>>>>New

Name: Name the profile and Save.

Under New configuration profiles

SCEP SETTING
SCEP>>>Configure SCEP.

URL: SCEP url copied earlier from Cloudpath SCEP profile created earlier.
Subject: CN=$DEVICENAME for IOS
Subject: CN=$COMPUTERNAME for OSX

Challenge and Verify Challenge: From Cloudpath SCEP Profile
Retires: 2
Retry Delay: 3

Key Size: 2048
Fingerprint: OCSP Hash from Cloudpath Intermediate CA

CERTIFICATE SETTING
Select Certificate>>>Configure Certificate

Import Root CA

Upload Root cert downloaded earlier from Cloudpath.

Click on + to add more cert.

Import Intermediate CA

Upload Intermediate cert downloaded earlier from Cloudpath.

NETWORK SETTING
Network >>>Configure Network>>>Configure

Service Set Identifier(SSID😞 Name of the SSID

Security Type: WPA2 Enterprise
Accepted EAP Types: TLS

Select TRUST tab as shown in this screenshot.

Identity Certificate: Select SCEP profile created earlier.
Trusted Certificates: Select Root CA and Intermediate CA.

Requirements:

Before embarking on the Guest Journey, ensure that you have:

A valid certificate in SmartZone
A valid certificate in Cloudpath
DNS entry for SmartZone
DNS entry for Cloudpath

Setup:

Cloudpath Setup:

Overall workflow:

1. Create a New Workflow from a blank canvas
2. Insert a step and add an Acceptable Use Policy
3. Add a MAC Registration step

1. NOTE:  You can use the variable ${sip} for the SmartZone.  This is useful when clustering SmartZone's together, please review SmartZone documentation on the "sip" variable if required.
   
   
2. Click Save
3. We need to complete the workflow with a step and a "kill session" option.  In this example, we are going to use the "Display a message" step, but there are others, such as Redirect User

SmartZone Setup:

1. Create a WLAN
2. Enable the Authentication type as Hotspot (WiSPr)
3. Enable the method as MAC Address

Note:  You can change the MAC address format to AA:BB:CC:DD:EE:FF, Cloudpath does that for you, but this can be changed

     4.Click on OK

     5.Change the Authentication server to Cloudpath

     6. OPTIONAL:  Change the Accounting Server to Proxy and point to Cloudpath

     7.SSH to SmartZone as 'admin' 

     8.Disable encrypted MAC addresses in SmartZone by using this command:

ruckuscontroller(config)# no encrypt-mac-ip
Do you want to continue to disable (or input 'no' to cancel)? [yes/no] yes
Successful operation

    9.If you do not run the above command, you will get the following MAC address in Cloudpath:

Guest Flow Experience

First Time Visitor:

Guest is visiting a location that is offering Guest Wi-Fi for the first time.  The end user experience will be to join a Guest WLAN, be redirected to a webpage, agree to terms and conditions, enter in email address, and then be authorized on to the guest Wi-Fi.

Returning User within Expiry Date

Returning User after Expiry Date

Will follow same flow as a first time visitor.

If a Sponsor would like to accept/ reject access to a guest user, in one step without having to review each and every guest network access request; one could use the following steps:

Steps:

Sponsors can get an email about when a user is trying to onboard/get access to a network through a Cloudpath Workflow:

The end user, in a workflow enters in information about the sponsor, and their own identity:

When the sponsor receives an email, they have an option to REVIEW the request. Clicking this will take you into Cloudpath sponsorship to review the entry.

Let’s make this a bit easier for John1, we can leave the review button, but, we can actually add an Accept and/or a Reject button. Pressing either of those buttons will have immediate impact to the end user, without having John1 access Cloudpath’s sponsorship portal.

1. Click on the Workflow
2. Open the Sponsorship workflow step
3. In this step, there is a HTML box for Sponsorship Email Message, the default is as follows:

If you click the (i) bubble beside this, you will see some more options:

 

We are going to add a Accept button and a Reject button for the sponsor to choose from

     4. Edit the HTML to add the variable buttons:

<html><body><div style='width: 320px; border: 1px solid #C0C0C0; margin: auto; padding: 10px;'><div style='padding-top: 10px;'>Wi-Fi access has been requested by ${NAME}.<br/>${SUMMARY}<div><br/>${REVIEW_BUTTON}<br/>${ACCEPT_BUTTON}<br/>${REJECT_BUTTON}</div></body></html>

     5. Publish the workflow!

     6. What John1 will see in the sponsorship email:

 

On a mobile device, when we choose/ select a field to type in any kind of data/ code, we often see the page does an auto zoom into the region/ field where the entry has to be made. This filed could be for username, email address, voucher code etc. This could be cumbersome at times. This short article could be useful for anyone who wishes to disable auto zoom on a CloudPath workflow page.

Steps:

A zoomed in page on a mobile device should look something like this:

As you can see, if I clicked on one of those fields to enter, the entire page zooms in for the user. Then the user is left scrolling out to hit, cancel, or send, or start over, depending on the page.

In Cloudpath, we can modify that behaviour so that when the user clicks on an input box, the browser does not zoom in!

Open a workflow

Click on Look & Feel Tab of the workflow

Scroll down to iOS Viewport:

Enter in the following: width=device-width, user-scalable=no

Save the Look & Feel

Publish the workflow

Observe the results on the page:

In some scenarios, The CSR is generated from CloudPath for a Wildcard Certificate and We use the same Wildcard Certificate for both CloudPath and SmartZone.

In such a situation Certificate import on CloudPath is done with a "Private key source" using the option "Certificate is based on downloaded CSR"

In order to use the same Wildcard Certificate on the SmartZone or etc. We need the Private Key to create the certificate .pem file.

• SSH into Cloudpath using the Credentials cpn_service
• Type 'console' and get to the Linux prompt.
• Then 'sudo su' to elevate to root access
• Location to find the files
  • Cd /etc/pki/tls/cert
• To open the file
  • Cat /etc/pki/tls/cert/certificate.cer (the public key)
  • Cat /etc/pki/tls/cert/ca_intermediate.cer (the chain Root/Intermediates for the webserver cert)
  • Cat /etc/pki/tls/private/certificate.key (the private key)
• We can copy the text from the shell and save it in a notepad in .pem or .key format to reuse.

Regards,

Vigneshwar Sivakumar

The auto-fill option allows a user to seamlessly and accurately apply a voucher code, or any such one-time-use codes. We can implement this very convenient feature for voucher code entry on CloudPath. 

Steps

A small edit to the HTML source code of the default voucher code entry page can help add the auto fill feature.

This is the current workflow that I have created, very simple, just asking a Guest to input their Mobile Phone number:

In Step 3, click on the blue text “verification code”. This will open up the step which is prompting users to obtain a Voucher from the voucher list “Guest Voucher List - 1 Day Access”.
NOTE Ensure that the format for the VOUCHER List are set to:

• ALPHANUMERIC (upper)
• ALPHANUMERIC (Lowercase)
• ALPHANUMERIC (Mixed)
• Numeric

In the resulting page, scroll down to Webpage Display Information. Change the Page Source: to “Upload HTML File”

Click on the download button beside “Default: Using default file.”

Open up the downloaded file in your favourite editor, I will use “Visual Studio Code” in this example.

In the file, do a search for “autocomplete”, there should be only a single entry there:

Edit the autocomplete=‘off’ to be autocomplete= ‘one-time-code’

Save the file.

Back to Cloudpath, in the page click on the “Choose File” button and upload the file that you saved:

 

Click Save on the page.

Deploy the Workflow

Continue through the workflow, enter you Mobile Number, when you re texted, you can simply click on the Verification Code: input box, and you will see a “From Messages XXXXXX” prompt show up.

Select the prompt on your phone and the Verification Code will be automatically filled out!

 

 

 

             This is a fun Quality of Life Improvement! I love that we have APIs in our applications since it really allows us to make quick changes within applications without having to access a GUI. I use APIs in testing and sometimes I want to load users into our DPSK Pools quickly, for testing. Now, I could do this in GUI, but if I am bulk uploading more than a few, this can be quite lengthy. Let’s do it through the API! We are going to use Postman to upload a CSV file with a username and password entered in it for our users.

We have had questions from customers that have asked for this functionality as well, which we point them to the documentation that is located here:

docs.commscope.com

Please point them to the RESTful API docs for Cloudpath located on that page.

If you have questions, please refer to that doc, in this QOL page we are going to show you importing a username/passphrase combination from a CSV file.

Create API key:

To begin with, let’s create an API key in Cloudpath:

1. Click on Configuration | API Keys
2. Click on Add API Key
3. Give it a name and an end date
4. Take note of the API key
5. Click on Save

You need a CSV file, with, at a minimum, a “name” column, and a “passphrase” column. You need to have these two values to create a DPSK.

Example:

POSTMAN:

Create a Collection:
This will contain our API calls for Cloudpath

In Postman, we are going to create a new Collection:

1. Click on Collections in the Scratch Pad on the Left
2. Click the + button to create a new collection
3. Name the New Collection for future reference

Create an Environment:
This will contain variables for us (such as AUTH token)

1. On the top right, you should see “No Environment”, it may appear as a eye behind a piece of paper, click the eye and paper
2. Click on ADD to create a new environment
3. Provide this with a name
4. In the VARIABLE column, enter in the word “token”

1. Click on SAVE

Create a API call to authenticate using a token:

1. In your collection, click on Add a request
2. Change to POST call
3. Enter in the URL for the API token, my example:https://cloudpath.ruckusdemos.net/admin/publicApi/token

1. Click on the Headers tab
2. In the KEY column, enter in “Authorization”
3. In the VALUE column, enter in “{{token}}”

1. Click on the Body tab,
2. Change to “raw”
3. Change the language to JSON
4. Enter in your credentials in this format: (once enterd, click on Beatify on the right to align the text)

{
“userName”: “username”,
“password”: “password”
}

1. Click on the Tests tab; we are going to create a test to auto-fill the “token” variable in Postman for us, then we can re-use this token in subsequent calls. Keep in mind that the token has a very short lifetime (like 5 mins) and has to be renewed before that time limit or created again.
2. In this field, enter in this information:

const response = pm.response.json();
pm.environment.set(‘token’, response.token);

1. Save
2. Click on SEND!
3. You will now see output down below with a Token a userName, token, serverVersion, and expireDateTime value. Also, if you look on the eye with paper showing the environment variable, the “token” should have a value assigned to it.

Let’s assume a DPKS pool is already created, if not, you can use APIs to create it as well.

Get a DPSK pool GUID to make DPSKs in

1. Create a new request in Postman
2. Make it a “Get”
3. Enter in the URL : https://cloudpath.ruckusdemos.net/admin/publicApi/dpskPools
4. In the Headers Tab, enter in the Authorization for the KEY and {{token}} for the VALUE

1. Save
2. If your Token has not expired run it, if it has, re-run your auth request. If your token is expired, you will receive a message stating that.
3. In the Results, look for the guid for your DPSK pool

1. Now, you know where you want to put the DPSKs (the GUID for that pool), let’s load in our file!

Create a RUN in Postman:

1. Create a new POST request
2. Add the URL:
   https://cloudpath.ruckusdemos.net/admin/publicApi/dpskPools/”DPSKPoolGUID”/dpsks

1. In the Parms tab, enter in two query parameters under KEY, one for name and one for passphrase
2. The VALUE column should be set to {{name}} and {{passphrase}}

The name and passphrase will be read from the file headers.

1. In the Headers tab, enter in your Authorization and {{token}} values
2. In the Body tab, enter in the following as JSON:

{
“name”: “{{name}}”,
“passphrase”: “{{passphrase}}”,
“status”: “ACTIVE”
}

1. Click on Save

If you token has expired… get a new one by running the auth call again.

Let’s load a file!
In Postman we can run a file through a collection and an API call.

1. Click on Your Collection on the left.
2. You will see that there is a “Run” button now located beside the “fork and save buttons”, click it

1. In the run order, only select the last API call that you created.
2. On the right, select your CSV file

Click “Run” to import the CSV file

If you look in the console of Postman, you will see the result and time taken:

In Cloudpath, we should see those entries for the DPSK pool:

Enjoy!

          One of the challenges in a workflow is if you want to create a variable based on a split. In a workflow, you can automate splits or make them user selectable, and those filters provide a lot of functionality very easily to a network administrator. We have introduced a new feature in Cloudpath that extends this functionality by allowing a network administrator to create a variable based on that split! The network administrator can then re-use that variable within a workflow or a policy. Let us examine how we can apply this!

Scenario:
We have a school that is allowing students and faculty to use BYOD. The school has asked for a single workflow and want to use DPSK. They will use an idP to provide authentication in the form of Active Directory. They want a single DPSK WLAN, but students MUST connect to VLAN 10, and Teachers MUST connect to VLAN 20.

In the past, we would have to key something off the idP or use some JavaScript to fill out that variable, which was not ideal. Using the variable creation on split solves this problem!

Let’s build the workflow!

I have a simple AUP page, Active Directory Server, then based on Group membership, there is an auto split! So as a student, I am automatically put in the student workflow, and as a teacher, I am automatically put in the faculty workflow. In both workflows, we are going to provide them a DPSK from the same DPSK pool (campus).

Student and Teacher Workflow:

Let us define a new Variable on the split for “Students”

Click the blue crayon beside the word Students in the workflow

Scroll down past the filters and look for Variable Assignments.

I am going to enter a variable name of “ASSIGNED.VLAN” and provide it with a value of 10:

I am going to close this and do something similar to the Faculty workflow, but instead of the value 10, I am going to enter in 20.

Now, we have the ASSIGNED.VLANs created for Students and Teachers (10 and 20 respectfully) which is the requirements. What we now going to do is use a POLICY for the DPSK pool, campus, to return that Variable in place of VLAN!

Click on Configuration | Policies | select RADIUS Attribute Groups from the window.

Click on Add RADIUS Attribute Group

Provide it a name

in the VLAN field, use your new variable called ${ASSIGNED.VLAN}

I am also go to add an attribute for User-Name and assign it the value ${USERNAME} (change the drop down menu to Add or replace (single), which will return the users’s username that we scraped from the idP in the workflow.

Save this RADIUS Attribute Group

Click on Conditions

Create a condition for all users and assign it the RADIUS Attribute Group that you created. In this condition, I am going to match on all users and when we do match, we will return the variable ${USERNAME} for the username and the ${ASSIGNED.VLAN} for the VLAN.

Now, if a student authenticates, we will return the username from idP and for the VLAN we will return 10 (based on the value created in the split). Likewise for teachers, we return their username and for the VLAN we will return 20 (based on the value created in the split for teachers).

Let’s see this in Action!

Student name: Alex Murphy
Teacher name: Clarence Boddicker

Alex has gone through the workflow and received their DPSK, we can see that information in an ENROLLMENT for the device, includes, within the Variables, at the top, the variable ${ASSIGNED.VLAN} with a value of 10.

When Alex now authenticates using their DPSK provided to them, in SmartZone, we can see the following VLAN and USERNAME returned to them:

And Clarence Boddicker:

Expected result of username and VLAN 20

Great Success!

So, this is just an example of how you can use the variable on split feature. you can also add multiple variables on that split too, so you can be as creative as you want.

Let’s configure a LOCAL server for DEMOING:

• Click on Configuration
• Click on Authentication Servers
• Scroll down to “Use Onboard Database”
(you can deselect “Include Admin Accounts” if you would prefer to NOT allow these users to log into Cloudpath as a local administrator.

• Click on Save at the top

In the authentication server list, you will now see “Onboard Database …. DB”

Let’s create some users! In this example, I am going to stick with a campus environment. We will have two types of users, Students and Faculty.
• Click the Disclosure Triangle beside “Server 1” to expand the menu:

• Click on the Button “Add User”
• Fill out the information, as you can see, you can add Group membership here! We will use this in our workflow. I have created a single user as a “student”

• Click on Save

Let’s create the Faculty member:
• Open the server disclosure triangle again
• Click on Add User
• Enter in the group “faculty” for this user:

• Click on Save

Workflow:
In the workflow, add an authentication server. In our workflow, I am going to insert a step after Step 1 to “Authenticate to a traditional authentication server”

• Add the “Authenticate to a traditional authentication server” after Step 1
• Select “Reuse an existing Authentication server” and select your internal DB:

• Click on Next
• Edit the Credential prompt screen to your liking, I will leave this as the default.
• Click on Save

Workflow so far:

Add a split! In this step, we will automatically select a split in the workflow for the end user based on group membership. I will create a split and a filter for “student” and “faculty”

• Insert a step after Step 2
• Select “Split users into different branches”
• Select “Use a new split.”
• Click Next
• Enter in a display name and two options, one for student and one for faculty:

• Click on Save
• Your workflow should appear similar to this:

• Click the blue pencil beside the word “students”
• Open up “Filters & Restrictions”
• In the field “Group Name Pattern:” enter in Student

• Click on Save
• In the workflow, you will see that there is a filter button beside students now, if you hover over it, you will see that if the condition is matched, the end user will automatically be put into that part of the workflow!

• Do the same for “Faculty” in the split, but obviously use the Group Name Pattern “faculty” in that split.
• Now, the rest of the workflow is up to you. If you want Students to get a EAP-TLS certificate with a Student template or get a DPSK from a pool create that in the workflow, for Faculty, this can be a completely different experience.
• In my example, I am just providing a message stating either Student or Faculty, so when I test this, I can immediately see the result!

Let’s try it!

• Publish your workflow!
• Click on the URL to start onboarding
• Results of the student onboarding:

• Results of the faculty onboarding:

Success!

MAC based authenticataion in a Cloudpath workflow had required the end user device to POST
to a network controller to be moved out of a walled garden. Using Ruckus.cloud, that
functionality is now available. In a workflow, you can now add the workflow step “Register the
device for MAC-based Authentication” in Cloudpath. A modification to the URL that the client
will POST to is available in this article.

Requirements:

Ruckus Cloud Tenant ID
This is in the URL of your Ruckus.Cloud account. Once you log into Ruckus.Cloud, in the URL
you will see the Tenant ID number after /t/. These characters represent the Tenant ID in
Ruckus Cloud.

You will require to copy and paste this into Cloudpath

                                                       Fig2. Drop down list showing Region

                                                    Fig3. Cloudpath Workflow for mac-auth

Create a workflow that uses MAC registration; in the example below, I have created a very
simple one that:
1. Prompts the user for accepting the AUP
2. Asks the user to enter in an email or SMS to receive a voucher
3. End user’s device’s MAC address is added to RADIUS + POSTS to Ruckus.Cloud for
authentication
4. End user’s device is redirected to https://www.ruckusnetworks.com

In step 3 of the Workflow, we need to edit the step so that it POSTS to Ruckus.Cloud:

1. In HTTPS Config Shortcuts: click on Ruckus SZ HTTPS, this will auto fill the form out for
you below:

                                                             Fig4. Auto fill form for SZ HTTPS

2. Modify the redirect URL: for Ruckus.Cloud; each region has a slightly different URL:
• If AP is in USA Region of Ruckus.Cloud, the URL that you must use is:
o https://*TENANT-ID_HERE*.wispr.ruckus.cloud/SubscriberPortal/hotspotlogin
• If AP is in EU Region of Ruckus.Cloud, the URL that you must use is:
o https://*TENANT-ID_HERE*.wispr.eu.ruckus.cloud/SubscriberPortal/hotspotlogin
• IF AP is in ASIA Region of Ruckus.Cloud, the URL that you must use is:
o https://*TENANT-ID_HERE*.wispr.asia.ruckus.cloud/SubscriberPortal/hotspotlogin
Replace *TENANT-ID_HERE* with your Tenant ID (see requirements on how to get it)

Example, My AP is in USA Region, I would change the REDIRECT URL in Cloudpath to:

                                     Fig5. Redirect URL for Ruckus.cloud in USA Region

3. Click Save
4. Publish Workflow

This is not a misinterpretation on Cloudpath.

Cloudpath uses the information provided from the iPad to determine the device type. The iPad sends it’s user agent information to Cloudpath (visible in an HTTP packet). The information contained within this user agent string determines the device type of the iPad.

If a certain iPad shows "MacOS Catalina" under device type, check the following settings on the iPad.

Settings > Safari > scroll down to “SETTINGS FOR WEBSITES” section > click on “Request Desktop Website” > On the next page, check if “All Websites” is enabled

If this setting is enabled, Safari browser utilizes desktop mode, instead of mobile mode. Hence, the browser identifies itself as MacOS, to cloudpath. (Based on user agent).

How to find user agent on iPad/ iPhone:

Open Safari and search for “my user agent”. You should see something similar to the following:

Copy the highlighted string. > Browse to https://explore.whatismybrowser.com/useragents/parse/

Paste the string here to parse the user agent. The above user agent string decodes to iOS 16.1.

If the above decoder is not available, just search for “decode user agent” on a search engine to find similar services.

On the other hand, if Settings > Safari > scroll down to “SETTINGS FOR WEBSITES” section > click on “Request Desktop Website” > On the next page, check if “All Websites” is enabled; you will see the user agent decoded as MacOS Catalina. Note the difference in the user agent string, between the two images. Both are sourced from the iPhone.

I had a SZ104 model of Ruckus controller installed in my premises. It has below firmware running on it:

Controller Version :5.2.1.0.515

For example:
Android client:

1. Tap the menu button on the top right of the screen (the three horizontal bars highlighted in the figure)
2. Click on “Show log”

We can also make use of the "Show Debug Logs"

3. Click on “Copy to clipboard”, save it in a document, and send them to the TAC support.
4. You can also select the Email log option to email the logs to you.
5. It should be the same for Windows and MAC as well.

Windows:

Mac:

NOTE: iOS devices don't use a wizard application to enroll.

I hope this will help!

Got any queries? Start the conversation!

Thank you!
Basav

Table of Contents

• DPSK Pool Config
  
• Property Management

DPSK Pool Config

Browser Configuration>>>DPSK Pools>>>Add DPSK Pool

Create DPSK Pool with below settings

• Display Name: Name as it is required.
• Passphrase: Length of Password
• SSID: SSID name.
• Device Limt: Number of devices allowed per DPSK.
  
  

and Click Save.

Once DPSK pool is created, start creating Properties.

Property Management

Properties>>>Managed Access>>>Add Property.

Create Property with below settings

• Display Name: Name as it is required.
• Pool: Select DPSK Pool created earlier
• Name: Name as it is required.
  

and Click Save.

Once property is created select Unit>>>Download Template.

Sample Downloaded Template as below

Modify details in excle, below setting is mandatory for creation, rest of the details are optional.

• Unit Number: Unit number in order, should not duplicate.
• DPSK Secret: Create DPSK, should not duplicate.
  
• Contact Name: Name of the Contact Person.

Once unit_template excel sheet is ready, upload using Import in Units as shown below.

Once file is selected, click Continue.

On successful import you will see Unit uploaded Results as below.

click Done.

Imported units will apear in the property as shown above and the entries will come up in DPSK pool as well shown below.

Thank You

I've poured countless hours into the configuration, and made a lot of progress, but ultimately have not been successful. Curious if anyone else in the community has worked out this mystery.