Not sure about "AC", but I use Aruba Instant clusters. I integrate user-id with PaloAlto two ways.
First, there is a native integration option
https://www.arubanetworks.com/techdocs/Instant_40_Mobile/Advanced/Content/UG_files/RTLS_conf/panFire...
Second, a syslog filter on the PaloAlto
Event Regex: User [aA]uthenticat(?:ed|ion)
Username Regex: username[-=]([a-zA-Z0-9\\._-]+)
Address Regex: [iI][pP][-=]([0-9.]+)
The syslog filter a backup in case the native integration fails. I am currently trying to report a bug with the native integration where the Aruba will use the PaloAlto API to send a logout followed immediately by a login for an IP. This often results in the login update not taking effect.
