Users Guide

610 | Behavior and Defaults Dell PowerConnect ArubaOS 5.0 | [User Guide
Default Management User Roles
The ArubaOS software includes predefined management user roles.
user-role <ssid>-logon
session-acl control
session-acl captiveportal
session-acl vpnlogon
This role is only generated when creating a new WLAN using the
WLAN Wizard. The WLAN Wizard creates this role when captive portal
is enabled and a PEFNG license is installed. This is the initial role that a
client will be placed in prior to captive portal authentication. By using a
different logon role for each SSID, it is possible to enable multiple
captive portal profiles with different customization.
user-role <ssid>-captiveportal-profile When utilizing the WLAN Wizard and you do not have a PEF NG
installed and you are configuring an Internal or Guest WLAN with
captive portal enabled, the controller creates an implicit user role with
the same name as the captive portal profile, <ssid>-captiveportal-
profile.
This implicit user role allows only DNS and DHCP traffic between the
client and network and directs all HTTP or HTTPS requests to the
captive portal. You cannot directly modify the implicit user role or its
rules. Upon authentication, captive portal clients are allowed full
access to their assigned VLAN. Once the WLAN configuration is
pushed to the controller, the WLAN wizard will associate the new role
with the initial user role that you specify in the AAA profile. This role
will not be visible to the user in the WLAN wizard.
Table 133 Predefined Roles (Continued)
Predefined Role Description
Note: If you upgrade from a previous ArubaOS release, your existing configuration may have different management roles. The
information in this section only describes the predefined management roles for this release.
Table 134 Predefined Management Roles
Predefined Role Permissions
root This role permits access to all management functions (commands and operations) on the
controller.
read-only This role permits access to CLI show commands or WebUI monitoring pages only.
guest-provisioning This role permits access to configuring guest users in the controller’s internal database only. This
user only has access via the WebUI to create guest accounts; there is no CLI access.
Guest-provisioning tasks include creating or generating the user name and password for a guest
account as well as configuring when the account expires.
location-api-mgmt This role permits access to location API information and the CLI; however, you cannot use any CLI
commands. This role does not permit access to the WebUI.
Using a third-party location appliance, you can gather information about the location of 802.11
stations.
To log in to the controller using a third-party location appliance, enter: http[s]://<ipaddress>[:port]/
screens/wms/wms.login.
You are prompted to enter your username and password (for example, the username and
password associated with the location API management role). Once authenticated, you can use
an API call to request location information from the controller, for example:
http[s]://<ipaddress>[:port]/screens/wms/wms.cgi?opcode=wlm-get-spot&campus-
name=<campus id>&building-name<building id>&mac=<client1>,<client2>....