Authentication Servers

You can use REST API calls to obtain information about all the authentication servers being used on your Cloudpath system.

updated to new URI for 5.9

The following table lists the properties that can be used in the body of an authentication server-related request and/or are provided in the response body. (In the "Optional" column, if a default value is applicable, it is listed in angle brackets (< >).)

Resource: Authentication Server

Property Name	Type	Editable	Sort/Filter	Optional in Request/Response Body?	Description
guid	String	No	orderBy, like	No	The unique identifier for this authentication server.
name	String	Yes	orderBy, like	No	The unique reference name of the authentication server.
detail	Object <Embedded>	Yes	See Object type for details	No	Indicates the details of the authentication server and its custom properties, especially "type" (such as AD, LDAP, OATUH, CUSTOM_OAUTH, RADIUS, and SAML)
adminLogin	Boolean	Yes	orderBy	No	Indicates if this authentication server should allow administration login to Cloudpath.
adminLoginRegex	String	Yes	orderBy, like	No	Users logging to Cloudpath using this authentication server will be required to belong to a group that matches this regex.
sponsorLogin	Boolean	Yes	orderBy,	No	Indicates if this authentication server should allow users to log into the sponsor portal.
useVlanRange	Boolean	Yes	orderBy	No	Indicates whether to allow a user on this authentication server to be assigned a configured auto vlan.
links[]	Link array	No	No	No	Includes a self-referencing link, and links to associated users and groups.

Resource: Certificate

Property Name	Type	Editable	Sort/Filter	Optional in Request/Response Body?	Description
style	Enum <String>	NO	none	NO	One of the following: PIN, CHAIN, UNCHANGED, NONE or BLOCK
serverName	String	NO	none	Yes	The server name from the provided X509 certificate.
issuer	List<String>	No	none	Yes	The list of issuers from the provided X509 certificate. The list of issuers depends on the chain or pin of the certificate.
startDate	Date<String>	No	none	Yes	ISO8601 Date – The start date from the provided X509 certificate.
endDate	Date<String>	No	none	Yes	ISO8601 Date - The end date from the provided X509 certificate.

Resource: Detail

Property Name	Type	Editable	Sort/Filter	Optional in Request/Response Body?	Description
type	String <ENUM>	No	orderBy, eq	No	Indicates the type of authentication server and its custom properties: AD, LDAP, OATUH, RADIUS, and SAML.
activeDirectory	Object <Embedded>	No	See resource.	Yes; cannot be combined with any other type.	The details needed for an active directory identity manager.
ldap	Object <Embedded>	No	See resource.	Yes; cannot be combined with any other type.	The details needed for an ladp identity manager.
saml	Object <Embedded>	No	See resource.	Yes; cannot be combined with any other type.	The details needed for a saml identity manager.
radius	Object <Embedded>	No	See resource.	Yes; cannot be combined with any other type.	The details needed for a radius to act as the identity manager.
facebookOauth	Object <Embedded>	No	See resource.	Yes; can be combined with LinkedIn, Google and custom.	The details needed to use Facebook Oauth.
linkedInOauth	Object <Embedded>	No	See resource.	Yes; can be combined with Facebook, Google, and custom.	The details needed to use Linked In Oauth.
googleOauth	Object <Embedded>	No	See resource.	Yes; can be combined with Facebook, LinkedIn and custom,	The details needed to use Google Oauth.
customOauth	Object <Embedded>	No	See resource.	Yes; can be combined with Facebook, Google and LinkedIn.	The details needed to use a custom oauth.

Resource: ldap

Property Name	Type	Editable	Sort/Filter	Optional in Request/Response Body?	Description
host	String	Yes	orderBy, like	No	The DNS/IP of the Active Directory server. For example: ldap://172.16.4.2
svrDistinguishedName	String	Yes	orderBy, like	No	The DN of the domain. For example: dc=test,dc=sample,dc=local
bindCredentialsType	String <ENUM>	Yes	none	No	USER, ADMININSTRATOR
bindUsername	String	Yes	none	Yes, but required if checkOcsp=true	The username used to bind to the LDAP server. For example, uid=bob,cn=users,dc=test,dc=cloudpath,dc=local. Required if OCSP has been selected
bindPassword	String	Yes	none	Yes, but required if checkOcsp=true	The password used to bind to the LDAP server.
checkOcsp	Boolean	Yes	none	No; default is "false".	If true, LDAP is queried during subsequent uses of the certificate to verify that the user account is still enabled.
ocspStatusFrequency	Number	Yes	none	No; defaults to 24 hrs	The number of milliseconds between rechecks of LDAP. For example, 86400000 (one day) will cause the system to check LDAP and then cache that answer for one day before checking again. 3600000 is one hour. 60000 is one minute.
searchFilter	String	Yes	none	No	LDAP search filter. In AD, this is (&(objectClass=user)(sAMAccountName={0})) or (&(objectClass=user)(userPrincipalName={0})).
searchCn	String	Yes	none	Yes	This is (&(objectCategory=group)(cn={0})).
domain	String	Yes	orderBy, like	Yes	The name of the domain. For example: test.sample.local
commonName	String	Yes	none	Yes	This is cn.
distinguishedName	String	Yes	none	Yes	This is dn
memberOf	String	Yes	none	Yes	This is memberOf.
mail	String	Yes	none	Yes	This is mail.
firstName	String	Yes	none	Yes	The first name. "gn"
lastName	String	Yes	none	Yes	The last name. "sn"
city	String	Yes	none	Yes	This is "l" in Ldap
state	String	Yes	none	Yes	This is the state "s" in Ldap
country	String	Yes	none	Yes	This is the country "c" in Ldap
ou	String	Yes	none	Yes	The Ldap "ou"
company	String	Yes	none	Yes	The company
department	String	Yes	none	Yes	The department
officeName	String	Yes	none	Yes	The office name
stripName	Boolean	Yes	none	Yes; default is true	If true, the username is stripped of the domain before being used in search queries.

Resource: saml

Property Name	Type	Editable	Sort/Filter	Optional in Request/Response Body?	Description
ipEntityId	String	Yes	orderBy, like	No	IdP Entity ID; this should match the value of the entityID attribute of the EntityDescriptor element within the IdP metadata XML.
spEntityId	String	Yes	orderBy, like	No	URI that uniquely identifies this Cloudpath authentication server configuration as a Service Provider (SP) to the IdP. This becomes the entityID attribute of the EntityDescriptor element within the SP metadata XML that will be uploaded to the IdP. The required format may vary by IdP.
metaType	String<Enum>	Yes	orderBy, like	No	IdP Metdata Type, which is how Cloudpath obtains IdP metadata -- either periodically fetched remotely from the HTTP URL or locally configured static. One of: XML.URL, STATIC_XML
metaUrl	String	Yes	none	No (if metaType=URL)	IdP Metadata URL, URL of SAML Metadata XML for the Identity Provider (IdP).
metaXml	String	Yes	none	No (if metaType=XML)	IdP Metadata XML; SAML Metadata for the Identity Provider (IdP) as static XML.
idpSsoBinding	String<Enum>	Yes	orderBy, like	No; default is REDIRECT.	REDIRECT or POST
assertionConsumer	String<Enum>	Yes	none	No; default is POST.	REDIRECT or POST
spAuthRequestsSigned	boolean	Yes	none	No; default= true	Returns "true" if the Sml request is signed, and "false" if the Sml request is not signed.
comparisonType	String<Enum>	Yes	none	No; default is MINIMUM	EXACT, MINIMUM, MAXIMUM, or BETTER
socketTimount	number	Yes	none	No; default is 10000.	Milliseconds for the socket timeout
encryptionSource	String<Enum>	Yes	none	No; Enum is: SERVER_WWW_CERT, CUSTOM_SPECIFIED	SP Encryption Certificate Source; defines certificate used for encryption by the local Service Provider (SP). This relates to the encryption certificate public key element within the SP metadata XML that will be uploaded to the IdP. Any changes to this certificate require SP Metadata to be re-generated and re-uploaded to the IdP.
signingSource	String<Enum>	Yes	none	NO; Enum is: SERVER_WWW_CERT, CUSTOM_SPECIFIED	SP Signing Certificate Source; defines certificate used for signing by the local Service Provider (SP). This relates to the signing certificate public key element within the SP metadata XML that will be uploaded to the IdP. Any changes to this certificate require SP Metadata to be re-generated and re-uploaded to the IdP.
username	String	Yes	none	Yes	Friendly Name of SAML Attribute to map to Username.
commonName	String	Yes	none	Yes	Friendly Name of SAML Attribute to map to Common Name.
memberOf	String	Yes	none	Yes	Friendly Name of SAML Attribute to map to Affiliation/Group Attribute. The value(s) of this attribute are processed as the user's Groups within Cloudpath.
ou	String	Yes	none	Yes	Friendly Name of SAML Attribute to map to OU.
distinguishedName	String	Yes	none	Yes	Friendly Name of SAML. Attribute to map to Distinguished Name.
email	String	Yes	none	Yes	Friendly Name of SAML. Attribute to map to Email.
firstName	String	Yes	none	Yes	Friendly Name of SAML. Attribute to map to First Name.
lastName	String	Yes	none	Yes	Friendly Name of SAML. Attribute to map to Last Name.
city	String	Yes	none	Yes	Friendly Name of SAML. Attribute to map to City.
state	String	Yes	none	Yes	Friendly Name of SAML. Attribute to map to State.
country	String	Yes	none	Yes	Friendly Name of SAML. Attribute to map to Country.
company	String	Yes	none	Yes	Friendly Name of SAML. Attribute to map to Company.
department	String	Yes	none	Yes	Friendly Name of SAML. Attribute to map to Department.
officeName	String	Yes	none	Yes	Friendly Name of SAML. Attribute to map to OfficeName.

Resource: radius

Property Name	Type	Editable	Sort/Filter	Optional in Request/Response Body?	Description
ipAddress	String	Yes	orderBy, like	NO	The DNS hostname (radius.company.com) or IP address of the RADIUS server.
port	number	Yes	orderBy	NO	The port on which the RADIUS server listens. This is typically port 1812.
sharedSecret	String	Yes	none	NO	The shared secret that permits the system to communicate with the RADIUS server. If this secret is incorrect, passwords will be corrupted during the RADIUS authentication.
callingStationId	String	Yes	orderBy, like	Yes	This value will be used as the Called-Station-Id attribute in the request. The Called Station ID is the identifier of the AP or controller. Typically, this the MAC address of the AP in ASCII format, which is appended to the Access-Request.
socketTimeout	number	Yes	none	Yes; default is 3000 (milliseconds)	The number of milliseconds to wait for the RADIUS server to respond to authentication requests. Default value of 3000 milliseconds (3 seconds) is appropriate in most cases.

Resource: activeDirectory

Property Name	Type	Editable	Sort/Filter	Optional in Request/Response Body?	Description
defaultDomain	String	Yes	orderBy, like	No	If a user does not specify a domain within the username, this Active Directory domain is used. For example, if this value is set to 'test.sample.local' and a user tries to login as 'bob', the login is converted to 'bob@test.sample.local'. But, if the user logs in as 'bob@other.local', this value is not applied.
host	String	Yes	orderBy, like	No	The DNS/IP of the Active Directory server. Example: ldap://hostabc.example.com or ldap://172.16.4.2. Use the fully qualified DNS name of the AD server for PEAP authentication.
distinguishedName	String	Yes	orderBy, like	No	The DN of the Active Directory domain. Example: dc=test,dc=sample,dc=local
searchBasis	String <Enum>	Yes	none	No, defaults to "SAM"	The attribute in Active Directory against which the username gets compared: SAM, UPN, NONE
checkOcsp	Boolean	Yes	none	No; default is "false"	If "true," Active Directory gets queried during subsequent uses of the certificate to verify that the user account is still enabled.
ocspStatusFrequency	Number	Yes	none	No; defaults to 24 hrs	The number of milliseconds to between rechecks of Active Directory. For example, 86400000 (one day) causes the system to check Active Directory and then cache that answer for one day before checking again. 3600000 is one hour. 60000 is one minute.
bindUsername	String	Yes	none	Yes, but required if checkOcsp=true	If specified, the bind credentials are used to lookup account status during subsequent uses of the certificate. The bind username must be fully specified, either as a SAM account name (such as TEST\bob) or a UPN (bob@test.com).
bindPassword	String	Yes	none	Yes, but required if checkOcsp=true	If specified, the bind credentials are used to lookup account status during subsequent uses of the certificate.
enabledForPeap	Boolean	NO	none	No; default is "false"	Indicates whether this active directory has been set up with PEAP. PEAP can be enabled from the Cloudpath UI.

Resource: facebookOauth

Property Name	Type	Editable	Sort/Filter	Optional in Request/Response Body?	Description
appId	String	Yes	none	No	The app ID for Facebook.
secret	String	Yes	none	No	The secret for Facebook.
scope	String	Yes	none	Yes	The scope for Facebook. If entering multiple scopes, use a comma-separated list..

Resource: linkedInOauth

Property Name	Type	Editable	Sort/Filter	Optional in Request/Response Body?	Description
apiKey	String	Yes	none	No	The API key for LinkedIn.
secret	String	Yes	none	No	The API secret needed for LinkedIn.

Resource: googleOauth

Property Name	Type	Editable	Sort/Filter	Optional in Request/Response Body?	Description
clientId	String	Yes	none	No	The Client ID for Google.
clientSecret	String	Yes	none	No	The Client secret for Google.

Resource: customAuth

Property Name	Type	Editable	Sort/Filter	Optional in Request/Response Body?	Description
name	String	Yes	none	Yes	The name to display to the end-user for the custom OAuth server.
description	String	Yes	none	Yes	The description to display to the end-user for the custom OAuth server.
consumerKey	String	Yes	none	Yes	The consumer key, similar to a username or API key, that identifies this server to the OAuth server.
consumerSecret	String	Yes	none	Yes	The consumer secret or password that identifies this server to the OAuth server.
accessTokenUrl	String	Yes	none	Yes	The access token endpoint URL for the OAuth server. For example, the Google URL is: https://www.googleapis.com/oauth2/v4/token.
authorizeUrl	String	Yes	none	Yes	The authorize URL for the OAuth server. For example, the Google authorize URL is: https://accounts.google.com/o/oauth2/auth.
dataUrl	String	Yes	none	Yes	The data URL for the OAuth server. For example, the Google URL is: https://www.googleapis.com/oauth2/v2/userinfo.
scope	String	Yes	none	Yes	The scope to send to the OAuth server. Each scope should be separated by a space. For example, the Google scopes are: profile email.

Authentication Servers URIs and Actions

The following table indicates the URIs that you can append to the root URI, along with the actions you can take, and possible return codes you can receive.

Authentication Servers URIs and Actions

URI	Action	Description	Return Codes
/authenticationServers	GET	Returns the list of all authentication servers in the Cloudpath system.	401 - Unauthorized 200 - Ok
/authenticationServers/{id}	GET	Returns details about the specified authentication server.	404 - Not found 401 - Unauthorized 200 - Ok

URI

Action

Description

Return Codes

/authenticationServers

GET

Returns the list of all authentication servers in the Cloudpath system.

401 - Unauthorized

200 - Ok

/authenticationServers/{id}

GET

Returns details about the specified authentication server.

404 - Not found

401 - Unauthorized

200 - Ok

Example of Using GET for Information About All Authentication Servers

This example demonstrates how to obtain information about all authentication servers on your Cloudpath system.

URI:

This example uses the following URI:

 https://Jeff245.cloudpath.net/admin/publicApi/authenticationServers

where https://Jeff245.cloudpath.net/admin/publicApi is the root URI of the Cloudpath system being used (must include https, as shown).

Request Headers:

The following table shows the required request headers for this URI example, with an example value of an active token that must be pasted into the Authorization header value:

Request Headers

Key	Value
Content-type	application/json
Authorization	eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJqZWZmLnJob2RpZUBjb21tc2NvcGUuY29tIiwicm9sZVBrIjoiMjEwMDAiLCJhY2NvdW50QWRtaW5QayI6IjIiLCJhcGlLZXkiOiJaV2NjTGpQZUdZMGUiLCJpYXQiOjE1NzU1NzUxNTcsImV4cCI6MTU3NTU3NTQ1N30.2q4KTyDUevkAAz7mJyp529Be1-ip3EC8P06Xarmz5ao

Request Body:

None required.

Action:

Use the GET action to send the request.

Response Body:

Once the request is sent, you will receive a "Status: 200 OK" if the GET is successful. The response body provides information about all existing authentication servers, which, in this example, shows one Active Directory server and one onboard RADIUS server.

{
    "page": {
        "page": 1,
        "pageSize": 2,
        "totalCount": 2
    },
    "contents": [
        {
            "guid": "1",
            "name": "Jack Test AD",
            "detail": {
                "type": "ACTIVE_DIRECTORY",
                "activeDirectory": {
                    "defaultDomain": "demo.sample.local",
                    "host": "ldaps://192.168.4.170",
                    "distinguishedName": "dc=demo,dc=sample,dc=local",
                    "searchBasis": "SAM",
                    "checkOcsp": false,
                    "ocspStatusFrequency": 86400000,
                    "bindUsername": "",
                    "bindPassword": "",
                    "enabledForPeap": false
                }
            },
            "adminLogin": false,
            "sponsorLogin": true,
            "useVlanRange": false,
            "adminLoginRegex": "",
            "links": [
                {
                    "rel": "self",
                    "href": "https://jeff245.cloudpath.net/admin/publicApi/authenticationServers/1",
                    "hreflang": null,
                    "media": null,
                    "title": null,
                    "type": null,
                    "deprecation": null
                },
                {
                    "rel": "groups",
                    "href": "https://jeff245.cloudpath.net/admin/publicApi/authenticationServers/1/groups?page=1&pageSize=10{&filter,orderBy}",
                    "hreflang": null,
                    "media": null,
                    "title": null,
                    "type": null,
                    "deprecation": null
                },
                {
                    "rel": "users",
                    "href": "publicApi/authenticationServers/1/users",
                    "hreflang": null,
                    "media": null,
                    "title": null,
                    "type": null,
                    "deprecation": null
                }
            ]
        },
        {
            "guid": "2",
            "name": "Jack Test DB",
            "detail": {
                "type": "ONBOARD"
            },
            "adminLogin": false,
            "sponsorLogin": true,
            "useVlanRange": false,
            "adminLoginRegex": "",
            "links": [
                {
                    "rel": "self",
                    "href": "https://jeff245.cloudpath.net/admin/publicApi/authenticationServers/2",
                    "hreflang": null,
                    "media": null,
                    "title": null,
                    "type": null,
                    "deprecation": null
                },
                {
                    "rel": "groups",
                    "href": "https://jeff245.cloudpath.net/admin/publicApi/authenticationServers/2/groups?page=1&pageSize=10{&filter,orderBy}",
                    "hreflang": null,
                    "media": null,
                    "title": null,
                    "type": null,
                    "deprecation": null
                },
                {
                    "rel": "users",
                    "href": "/publicApi/authenticationServers/2/users",
                    "hreflang": null,
                    "media": null,
                    "title": null,
                    "type": null,
                    "deprecation": null
                }
            ]
        }
    ]
}

Cloudpath Enrollment System REST API User Guide, 5.9R4 800-73101-001 Rev A

Authentication Servers

Resource: Authentication Server

Resource: Certificate

Resource: Detail

Resource: ldap

Resource: saml

Resource: radius

Resource: activeDirectory

Resource: facebookOauth

Resource: linkedInOauth

Resource: googleOauth

Resource: customAuth

Authentication Servers URIs and Actions

Authentication Servers URIs and Actions

Example of Using GET for Information About All Authentication Servers

Request Headers