topic Re: Superuser (read-only) Not authorized to access in General Topics

Superuser (read-only) Not authorized to access

MichaelBorg — Mon, 12 Aug 2024 15:28:05 GMT

Hi everyone,

I am trying to get TACACS working between our PA and Aruba Clearpass authentication server. I have successfully done this for full admin as well as a custom role on the firewall. I am however running into issues with a service account logging in with read only access.

When I try to login to the local firewall with this service account I get the message "Not authorized to access" (please see screenshot PACLP1.PNG). This is further confirmed by the firewall systems logs (please see screenshot PACLP2.PNG). The role name that I specified in Clearpass is correct however, I copied and pasted the name from the local firewall account role into Clearpass so this should be fine (please see screenshot PACLP3.PNG).

This worked fine with the local firewall account but something is wrong with the authorization of this Clearpass integration. Not sure if this matters but when the service account was local on the firewall and working it was using Radius but with this Clearpass integration I'm using TACACS. I don't think this is an issue as 2 different types of login (normal firewall superuser as well as a custom role) work fine. Can anyone please advise. Thank you in advance.

Re: Superuser (read-only) Not authorized to access

MichaelBorg — Mon, 12 Aug 2024 15:47:53 GMT

Update - I created a custom role on the firewall and made it as read-only as I can and that works fine. Am I not able to successfully reference the dynamic firewall Superuser (read-only) role? This works for the dynamic Superuser role so I thought it would work.

Re: Superuser (read-only) Not authorized to access

BPry — Mon, 12 Aug 2024 21:49:41 GMT

@MichaelBorg,

Try using superreader as the value, that's what the firewall actually uses on the backend.

Re: Superuser (read-only) Not authorized to access

MichaelBorg — Thu, 15 Aug 2024 16:07:29 GMT

Hi,

Sorry for the delay. Many thanks for that advise, I'll try that tomorrow and let you know.

Re: Superuser (read-only) Not authorized to access

MichaelBorg — Mon, 19 Aug 2024 15:33:12 GMT

Thank you Bpry, adding superreader instead worked 🙂