Aruba ClearPass

Interact with Aruba ClearPass API

Actions34

Overview

This node integrates with the Aruba ClearPass API to manage device accounts within the "Devices" resource under the "Identities" domain. Specifically, the "Replace" operation allows users to fully replace an existing device account's details by specifying its MAC address and other attributes. This is useful for updating device information such as role assignments, activation status, time-based access controls, and custom metadata in a single atomic action.

Common scenarios include:

  • Updating a device’s role or permissions when it changes network segments.
  • Enabling or disabling device access based on policy changes.
  • Setting start and expiry times for temporary device accounts.
  • Adding descriptive notes or sponsor information for visitor devices.

Practical example: A network administrator wants to update a device’s role to "Guest", set it to expire after 24 hours, and add a sponsor name for auditing purposes. Using this node’s Replace operation, they can provide the MAC address and all updated fields in one request.

Properties

Name Meaning
Domain The API domain to access. Options: Identities, Policy Elements, Enforcement Profile. For this operation, must be Identities.
Device ID The unique identifier of the device account (used in some operations but not for Replace by MAC).
MAC Address The MAC address of the device to replace. This identifies which device account will be replaced.
Role ID Numeric ID of the role to assign to the device account.
Additional Fields Optional extra fields to customize the device account:
- Role Name: Name of the role.
- Enabled: Boolean to enable/disable the account.
- Start Time: ISO 8601 datetime when the account becomes active.
- Expire Time: ISO 8601 datetime when the account expires.
- Visitor Name: Display name for the device.
- Sponsor Name: Name of the sponsor.
- Sponsor Profile: Numeric profile ID of the sponsor.
- Notes: Comments or notes.
- Source: Origin of the account.
- Custom Fields: JSON object with additional custom data.
Options Additional options for the operation:
- Change of Authorization: Whether to send a Disconnect-Request or CoA-Request to update network state. Options: Use Default Setting, Yes, No.

Output

The node outputs an array of items where each item contains a json property representing the response from the Aruba ClearPass API after replacing the device account. The exact structure depends on the API response but typically includes confirmation of the updated device details.

If the operation fails and "Continue on Fail" is enabled, the output will contain an error message in the json.error field.

No binary data output is indicated.

Dependencies

  • Requires an API key credential configured in n8n to authenticate with the Aruba ClearPass API.
  • The node relies on an internal helper function (executeOperation) to perform the actual API call.
  • Proper network connectivity to the Aruba ClearPass server is necessary.

Troubleshooting

  • Common issues:

    • Invalid or missing MAC address: The operation requires a valid MAC address to identify the device.
    • Incorrect role ID or role name: Ensure the role exists in ClearPass and the ID/name matches.
    • Authentication failures: Verify that the API key credential is correctly configured and has sufficient permissions.
    • Date/time format errors: Start and expire times must be in ISO 8601 format.
    • Network errors or timeouts connecting to ClearPass API.

  • Error messages:

    • Errors thrown by the API are logged and, if "Continue on Fail" is enabled, returned as part of the output.
    • Common error messages may include authorization errors, validation errors for input fields, or resource not found errors if the device does not exist.

  • Resolution tips:

    • Double-check all required fields and their formats.
    • Confirm API credentials and network access.
    • Use the node’s logging output to diagnose issues.

Links and References

Discussion