ClearPass Extension for BMC Remedy TechNote. ClearPass Extension For BMC Remedy. ClearPass. ClearPass Extension for BMC Remedy - TechNote 1

Transcription

1 ClearPass Extension for BMC Remedy TechNote ClearPass Extension For BMC Remedy ClearPass TechNote ClearPass Extension for BMC Remedy - TechNote 1

2 ClearPass Extension for BMC Remedy TechNote Change Log Version Date Modified By Comments 0.1 Jan 2017 Danny Jump Initial draft version for internal review 0.2 Jan 2017 Bob Filer Format cleanup and wordsmithing 1.0 Jan 2017 Danny Jump First Published Version Copyright Copyright 2017 Hewlett Packard Enterprise Development LP. Open Source Code This product includes code licensed under the GNU General Public License, the GNU Lesser General Public License, and/or certain other open source licenses. A complete machine-readable copy of the source code corresponding to such code is available upon request. This offer is valid to anyone in receipt of this information and shall expire three years following the date of the final distribution of this product version by Hewlett- Packard Company. To obtain such source code, send a check or money order in the amount of US $10.00 to: Hewlett-Packard Company Attn: General Counsel 3000 Hanover Street Palo Alto, CA USA Please specify the product and version for which you are requesting source code. You may also request a copy of this source code free of charge at HPE-Aruba-gplquery@hpe.com. ClearPass Extension for BMC Remedy - TechNote 2

3 ClearPass Extension for BMC Remedy TechNote Contents Introduction and Overview... 6 Software Requirements... 6 ClearPass Installation and Deployment Guide... 6 ClearPass Extensions... 6 Special Note for the BMC Remedy Extension... 7 Pictorial View of the Integration... 7 Remedy BMC Extension Installation and Configuration... 8 Create an Operator Profile... 8 Create an API Client... 9 Generate an Access Token Go to the Extension APIs Install the Extension Query Extension after Installation Configure the Extension Starting the Extension Verify the Extension is Running Troubleshooting the Extension Configure ClearPass Policy Manager Determine ClearPass Internal IP Address Context Server Configuration Context Server Action Configuration Action Tab Header Tab Content Tab Enforcement Action Locating the Fields-Names in Remedy Appendix A Additional Diagnostics and Support Checking on the Extension Service Extension Logs/Debugging Accessing the extension logs using Collect Logs system function Appendix B Considerations for Installing in a Cluster Extension Installation Procedure for a Subscriber Extension IDs in a Cluster ClearPass Extension for BMC Remedy - TechNote 3

4 Figures Figure 1: Pictorial view of the ClearPass integration with BMC Remedy... 7 Figure 2: Duplicate API Guest Operator profile... 8 Figure 3: Modifying Operator Profile permissions for extensions... 9 Figure 4: Creating your API client Figure 5: Generate the Access Token Figure 6: API Explorer UI Figure 7: Accessing the Store API Figure 8: Checking in the Extension store for a particular Extension ID Figure 9: Details of the Extension Figure 10: Installing the Extension directly from the Extension store Figure 11: Extension Status Figure 12: Checking Extension Installation Progress Figure 13: Response to check on progress of Extension installation Figure 14: Get Extension Configuration Figure 15: Response to a request for the current Extension configuration Figure 16: Configuring the Extension Figure 17: Starting the Extension Figure 18: Expected HTTP response to InstanceStart Figure 19: Checking on the state of the Extension Figure 20: Detailed information on the running Extension Figure 21: Getting Debug Logs from the Extension Figure 22: Recording the internal IP address in use by the extension Figure 23: Adding a Context-Server to communicate with the extension Figure 24: Context-Server-Action Action Tab Figure 25: Context-Server-Action Header Tab Figure 26: Context-Server-Action Content Tab Figure 27: List of tickets in Remedy Figure 28: Detailed Remedy Incident Figure 29: Creating an enforcement profile Figure 30: An Enforcement Policy that triggers the Incident creation Figure 31: Finding the field names in Remedy Figure 32: Displaying the fields in the HPD:IncidentInterface_Create form Figure 33: Services Control Figure 34: Setting debug logging on Figure 35: Getting Logs out of an extension Crossman Avenue Sunnyvale, CA Phone: WIFI-LAN ( ) 2017 Hewlett Packard Enterprise Development LP. All Rights Reserved. Fax ClearPass Extension for BMC Remedy - TechNote 4

5 Figure 36: Locating the Extension logs from 'Collect Logs' diagnostic GZ file Figure 37: Subscriber with no "Generate Key" option Figure 38: Generate API Key in Publisher and copy it Figure 39: Entering the HTTP Authorization key into the Subscriber ClearPass Extension for BMC Remedy - TechNote 5

6 Introduction and Overview This TechNote covers the integration between Aruba s ClearPass Policy Manager and BMC Remedy 9 Incident and Ticketing system. Remedy 9 is a powerful service management platform widely deployed by enterprises and built natively for mobile with an intuitive, beautiful, people-centric user experience that makes everybody more productive. This integration is one way, meaning that Using the instructions that follow, you will be able to configure ClearPass Policy Manager to open incident tickets in BMC Remedy based upon authentication events in ClearPass. At this time the integration between ClearPass and BMC Remedy is unidirectional (i.e. ClearPass cannot query information FROM Remedy, only post incident tickets TO it). Note: the APIs to support ClearPass Extensions were initially released in CPPM version 6.6. Software Requirements The minimum software version required for ClearPass is At the time of writing, ClearPass is the latest available and recommended release. Any subsequent ClearPass software release will support this integration. ClearPass runs on either hardware appliances with pre-installed software, or as a Virtual Machine under the following hypervisors. Hypervisors that run on a client computer such as VMware Player are not supported. VMware ESXi 5.0, 5.1, 5.5, 6.0, or higher Microsoft Hyper-V Server 2012 R2 Hyper-V on Microsoft Windows Server 2012 R2 KVM on CentOS 6.6, 6.7, or 6.8. Version 9 of BMC Remedy was used during the development of this integration. Please check with BMC to ensure the required APIs exist within your deployed version of the product. ClearPass Installation and Deployment Guide This document assumes your ClearPass environment is already configured and operational. If you require assistance with basic deployment, refer to the following deployment guide: ClearPass Extensions The integration between ClearPass Policy Manager and BMC Remedy is driven through a ClearPass capability known as Extensions, a sub-component of the ClearPass Exchange Integration framework. ClearPass Extensions are micro-services running on top of the base ClearPass platform. These microservices enable Aruba to deliver new features outside of the main software release cycle and facilitate a ClearPass Extension for BMC Remedy - TechNote 6

7 faster time to market for specific features and integrations. Configuration and control of ClearPass Extensions is accomplished through the ClearPass REST APIs. Special Note for the BMC Remedy Extension The integration with BMC Remedy uses a special extension called the Generic Authentication Proxy. This extension expands on the capabilities of ClearPass Context Servers by providing additional authentication methods such as JSON Web Tokens (JWT), HTTP Token Authentication, and OAuth2. The standard ClearPass Context Servers only support basic HTTP authentication with limits the environments in which they can be used. The Generic Authentication Proxy extension provides valuable additional support by enabling additional authentication types while still using the powerful ClearPass Exchange Context Servers. The below data provides a guide and an overview of integration between CPPM and Remedy. This is not an exhaustive capture of all possible integration touch-points between the two products but is an overview in how CPPM can automatically create incident tickets in the Remedy ITSM application. Pictorial View of the Integration Below is a pictorial representation of the integration between ClearPass Policy Manager, the ClearPass Remedy Extension, and the BMC Remedy Application. The below provides an easy way to visualize the components and how they interact. Figure 1: Pictorial view of the ClearPass integration with BMC Remedy ClearPass Extension for BMC Remedy - TechNote 7

8 Remedy BMC Extension Installation and Configuration Installation of the BMC Remedy ClearPass Extension is performed via the ClearPass REST API interface. ClearPass REST APIs were initially introduced in CPPM 6.5 and have continued to be enhanced in subsequent releases. Access to the APIs is through the following URL You have to provide Admin credentials as usual to access the API interface. Note: the APIs to support ClearPass Extensions were initially released in CPPM version 6.6. Several components and multiple steps are required to complete the CPPM/Remedy configuration Extension Installation and Configuration Context Server Configuration Context-Server-Actions Configuration New or existing Enforcement Policy Configuration The CPPM extension installation is shown below. Follow these steps to complete the required configuration for the BMC Remedy Extension. Create an Operator Profile Before setting up the API access, you must configure an Operator Profile that will be associated with the configured API client. This new Operator Profile will be used in the next section when creating the API Client. Login to Guest and go to Administration > Operator Logins > Profiles. Next, click on API Guest Operator and select Duplicate. Figure 2: Duplicate API Guest Operator profile ClearPass will copy the profile and name it API Guest Operator (2). Click Edit on the new profile and rename it to be API Extension Profile. For the Platform privilege, change No Access to Custom and then set all the Extension options as shown below (furthest option to the right). Scroll to the bottom of the page and click Save. ClearPass Extension for BMC Remedy - TechNote 8

9 Figure 3: Modifying Operator Profile permissions for extensions In the next step, this profile will be used as the Operator Profile when generating the API Client. Create an API Client The next step in installing and enabling the BMC Remedy ClearPass Extension is to create an API Client. An API client provides authentication and authorization for the REST APIs. Authentication is performed using OAuth2, which is an authorization framework that enables applications to obtain limited access to data over a HTTP service without sharing their private credentials. Log into ClearPass Guest at ClearPass-Server>/guest Navigate to Guest > Administration > API Services > API Clients and create an API client by entering the following: 1. Client ID: Your choice 2. Operator Profile: API Extension Profile [just created] 3. Grant Type: Client credentials ClearPass Extension for BMC Remedy - TechNote 9

10 Figure 4: Creating your API client Note: Keep a record of the Client Secret as it won't be displayed again. Click on Create API Client to save and create the API Client. Generate an Access Token Click Generate Access Token and then launch the API Explorer, as highlighted below at the bottom of the image. ClearPass Extension for BMC Remedy - TechNote 10

11 Figure 5: Generate the Access Token This will pre-populate the Authorization header in the API Explorer and allow you to try commands directly from the ClearPass UI. Go to the Extension APIs Next we will check we can communicate with the Extension store, Click on Extension > Store. Figure 6: API Explorer UI Under Store, click GET /extension/store/{id} Figure 7: Accessing the Store API Notice that the Authorization header is populated. This is populated from creating the token in the previous step. Next you should expand the GET /extension/store/{id} and paste in the extension's store ID. ClearPass Extension for BMC Remedy - TechNote 11

12 Note: The store ID for the BMC Remedy extension is a fixed value of: 0c1b4206-b633-4a13-82c9-013b18d38d4e. Click Try it out! Figure 8: Checking in the Extension store for a particular Extension ID Note: Remember that the store ID of 0c1b4206-b633-4a13-82c9-013b18d38d4e is unique to this version of the BMC Remedy Extension. The store ID will change as new versions of the Extension are published. This will return details for the BMC Remedy Extension, and provides assurance that you have access to the Extension Store and this is the correct ID for the extension you want to install. Figure 9: Details of the Extension ClearPass Extension for BMC Remedy - TechNote 12

13 Install the Extension After checking for extension visibility, the next step is to install it. Under Instance > POST /extension/instance, paste in the body as shown below: {"state": "stopped", "store_id":"0c1b4206-b633-4a13-82c9-013b18d38d4e"} And then click Try it out! Figure 10: Installing the Extension directly from the Extension store Note: This will return an Extension ID (Note: this is different from the store ID). Make a copy of this ID as it will be required later. Notice in the JSON body, the extension is installed in the stopped state. The below shows the state of the Extension as preparing. This indicates the extension has successfully installed and deployed. The state may also show downloading, stopped, installing, or failed. A typical installation should take just a few seconds to complete. ClearPass Extension for BMC Remedy - TechNote 13

14 Figure 11: Extension Status From the above, you can see the Extension ID is 1e5d7c13-65ef a1a-ef581e9c564a.This ID will be used to query and configure the extension. Warning: Your Extension ID will be different from the one used here. It is generated per installation and is unique to each installation. Query Extension after Installation Under Instance > GET /extension/instance/{id} paste in the ID from the previous step: b3f019cf-b9d1-408b-97e5-879e000eb9c1 and click Try it out!, remember your ID will be different. ClearPass Extension for BMC Remedy - TechNote 14

15 Figure 12: Checking Extension Installation Progress Within the Body Response from this GET you should see the following: Figure 13: Response to check on progress of Extension installation ClearPass Extension for BMC Remedy - TechNote 15

16 The details of the extension will be displayed (could be downloading, etc.). Eventually the state will change to either stopped or failed. In this example it is clear the that the installation is created and stopped. Configure the Extension The extension must be configured before it can be started. Begin by getting the current configuration. Under InstanceConfig > GET /extension/instance/{id}/config, paste in the extension ID b3f019cf-b9d1-408b-97e5-879e000eb9c1 and click Try it out! to return a copy of the current Extension configuration. Figure 14: Get Extension Configuration Figure 15: Response to a request for the current Extension configuration ClearPass Extension for BMC Remedy - TechNote 16

17 The above example, shows the default shipping configuration. This needs to be changed to match your environment, the configuration here depends on the authentication type being completed. In the example above, there are multiple configuration parameters that can be changed etc. verifysslcerts, loglevel, localprefix, authtype, tokenendpoint, apiendpoint etc. The use of these configuration options will heavily depend on the type of authentication being deployed, below we discuss BMC Remedy. Note: The configuration properties available for the extension will be displayed in JSON format. A sample configuration is shown here: { } "verifysslcerts": false, "loglevel": "INFO", "configs": [ { "localprefix": "/bmc", "authtype": "JWT", "JWT": { "tokenendpoint": " "apiendpoint": " "customauthmethod" : "AR-JWT", "authparams" : { "username": "apiuser", "password": "password" } } } ] From the above there are a number of key values that you ll need to update before configuring the extension. Copy the above code to your favorite text editor and modify accordingly. 1. tokenendpoint this is the IP address of the BMC Remedy system, in our example we show , you ll change this as needed to match your system. 2. apiendpoint - this is the IP address of the BMC Remedy system, in our example we show , you ll change this as needed to match your system. 3. authparams - username & password, these need to be changed as appropriate to match your system. Note: The configuration properties available for the extension will be displayed in JSON format. Under Instance > PUT /extension/instance {id}/config, paste in the extension ID and the configuration you just prepared as shown below and click Try it out!. ClearPass Extension for BMC Remedy - TechNote 17

18 Figure 16: Configuring the Extension The response if the configuration is successfully formatted, should be a 204. Following this step the extension can now be started. Under InstanceStart > POST /extension/instance/{id}/start paste in the extension ID and click Try it out!. A successful response will be a 204. Note: If the configuration is changed, it is best practice to restart the extension via InstanceRestart > POST /extension/instance/{id}/restart ClearPass Extension for BMC Remedy - TechNote 18

19 Starting the Extension Under InstanceStart > POST /extension/instance/{id}/start, paste in the extension ID and click Try it out!. Figure 17: Starting the Extension A successful result is indicated by a 204 No Content result as shown below. Figure 18: Expected HTTP response to InstanceStart Verify the Extension is Running Under Instance > GET /extension/instance/{id} copy and paste the extension ID and click Try it out! ClearPass Extension for BMC Remedy - TechNote 19

20 Figure 19: Checking on the state of the Extension The state of the extension should be running. An example of the HTTP response is shown below: Figure 20: Detailed information on the running Extension Note: The internal_ip_address of the extension will be auto-configured. This will be used to configure a Context Server later in ClearPass. Make a note of the IP. ClearPass Extension for BMC Remedy - TechNote 20

21 Troubleshooting the Extension Under InstanceLog > GET /extension/instance/{id}/log, paste in the extension ID. Enter a value for tail, e.g. 100 will show the last 100 lines of logs, then click Try it out!. Note that other settings are applicable when getting logs, e.g. timestamps. Figure 21: Getting Debug Logs from the Extension Configure ClearPass Policy Manager Following the deployment and configuration of the BMC Remedy Extension, the next step is to configure a Context Server within ClearPass. To do this, you will need the internal IP address of ClearPass so the extension has something to communicate with. Determine ClearPass Internal IP Address Under Instance > GET /extension/instance/{id}/ paste in the extension ID and click Try it out!. Make note of the IP address returned by the query. The example below shows an IP address of Warning: If multiple extensions are deployed on the same node, it s possible, though unlikely, that the internal IP address will change. ClearPass Extension for BMC Remedy - TechNote 21

22 Figure 22: Recording the internal IP address in use by the extension Context Server Configuration The next step is to define a context-server. This configuration will point to the extension using the internal IP address determined in the previous step. Go to Administration > External Servers > Endpoint Context Servers and Add a Generic HTTP Server from the drop down. Use the IP address recorded in the previous step as the Server Name. Warning: Insure you modify the Server Base URL from HTTPS to HTTP. ClearPass Extension for BMC Remedy - TechNote 22

23 Figure 23: Adding a Context-Server to communicate with the extension Context Server Action Configuration Once the context-server is defined, the next step is to define the context-server-action. This part of the configuration takes variable substitutional metadata and embeds it in the Remedy API call to create the incident ticket. The example below sends the data to Remedy using the context-server and the Generic Authentication Proxy, which in turn forwards it to Remedy to create the incident ticket. In the following example a number of ClearPass namespaces and attributes have been used, but you can choose to build your message structure with other variables as required. In a subsequent section, you will find instructions on how to find the field-names from within the Remedy system that can then be defined in ClearPass and used to populate the incident tickets with additional data. To begin, go to Administration > Dictionaries > Context-Server-Actions and click on Add in the top righthand corner of the page. Figure 24: Context-Server-Action Action Tab Action Tab There are a number of items to configure on the Action Tab. Complete each field as shown below: 1. Server Type: Generic HTTP 2. Server Name: IP Address of the Context Server defined in the previous section 3. Action Name: define as appropriate ClearPass Extension for BMC Remedy - TechNote 23

24 4. HTTP Method: POST 5. Skip HTTP Auth: Check 6. URL: /bmc/entry/hpd:incidentinterface_create Header Tab On the Header Tab, set the Content-Type equal to application/json as shown below. Figure 25: Context-Server-Action Header Tab Content Tab On the Content Tab, set the Client-Type to JSON in and then enter the JSON content required to create the incident ticket. This content will vary slightly based on your Remedy installation, but should follow the general format shown below. Figure 26: Context-Server-Action Content Tab The main configuration for the integration is completed by defining the Content body on the Content Tab. This section is crucial in extracting the valuable data out of CPPM that will be used to create the Incident Ticket in Remedy. ClearPass Extension for BMC Remedy - TechNote 24

25 Note: To aid with creating the above configuration, we have provided as a starting template the JSON data here. This will need to be amended to suit your needs but this is a good starting point. Copy and amend as necessary. { "values" : { "First_Name" : "Allen", "Last_Name" : "Allbrook", "Description" : "User %{Authentication:Full-Username}, on NAS Ctrl %{Connection:NAD- IP-Address} is using an un-registered Intune device of type %{Authorization:[Endpoints Repository]:Device Name}", "Impact" : "1-Extensive/Widespread", "Urgency" : "1-Critical", "Status" : "New", "Vendor Ticket Number" : "012345ABC", "Reported Source" : "Direct Input", "Service_Type" : "Infrastructure Event", "Detailed_Decription" : "Detail_Desc_Field_example123" } } In the example above, only a subset of the fields available from Remedy have been used. These are being populated with some substitutional values relevant to this incident (e.g. the Username, the IP address of the NAS and the Device Name), and some fixed attributes such as the Impact Level, Urgency, Status, Report Source, Service Type and Detailed Description. Note: The fields above could also use substitutional values. You could build multiple context-server-actions which represent the differing types and severity of the incident tickets that need to be created. This context server action could be used in a service policy that is part of an authorization check which makes a call to Microsoft s Intune MDM service checking for an enrolled, known and managed device. The above context server action could be used to create a ticket in Remedy if the authorization check fails. This would then alert the HelpDesk and associated personnel of an unmanaged/unknown device being connected to the network and the necessary remediation can take place. Being able to track and provide visibility for this non-compliant event could be critical. Note: In the context server action shown above, the fields First_Name and Last_Name must match an existing enrolled Remedy user in order to create incident tickets. Shown below are several examples of incident tickets automatically created in Remedy using the BMC Remedy extension. ClearPass Extension for BMC Remedy - TechNote 25

26 Figure 27: List of tickets in Remedy This is a high-level summary screen. An additional level of detail can be obtained by drilling down into the individual tickets. An example is shown below. ClearPass Extension for BMC Remedy - TechNote 26

27 Figure 28: Detailed Remedy Incident ClearPass Extension for BMC Remedy - TechNote 27

28 Enforcement Action CPPM can automatically create the incident tickets in Remedy, however to do this requires that a new Enforcement Profile be created. Go to Configuration > Enforcement > Profiles and click Add. Choose type HTTP Based Enforcement in the Template. Provide a Name and if desired a Description. On the Attributes tab set the Target Server to the Context Server previously defined. Set the Action attribute to the Context Server Action previously created. Figure 29: Creating an enforcement profile Once the Enforcement Profile is created, it must then be added to an Enforcement Policy. In the below example, the Enforcement Profile has been added to the first condition where the Profile will be executed if the device is NOT managed [msft_ismanaged EQUALS false] and thus unknown to Intune. Figure 30: An Enforcement Policy that triggers the Incident creation ClearPass Extension for BMC Remedy - TechNote 28

29 Locating the Fields-Names in Remedy There are many field names that can be populated with data when ClearPass creates the incident ticket. Being able to identify what the field names are called in Remedy is critical so you can adjust the Context Server Action to populate the required fields. Each customer will use different fields to create their tickets as their demands to collect different data and raise incident tickets will vary. To locate the field names, logon to the underlying Windows Server and open the BMC Remedy Developer Studio application. Expand localhost > All Objects > Forms, then go to HPD:IncidentInterface_Create and open the form. Figure 31: Finding the field names in Remedy In the form HPD:IncidentInterface_Create you will see the displayed form, but more importantly you will see all of the fields on the form. Some work is required to find the correct field name you need, but this should provide enough the guidance to locate the field names. In the bottom half of the screenshot below is the form you would manually complete if you were creating an incident ticket manually. These fields are available for you to use with the BMC Remedy extension. You just need to capture the field name. In the example, the Reported Source form field has been highlighted. On the right-hand side, the properties of this field are shown, and most importantly the actual field name is shown. This is the field name you would use in your context server action. The JSON Content shown previously in the content server action used this field and assigned it a fixed value Reported Source : Direct Input". ClearPass Extension for BMC Remedy - TechNote 29

30 Figure 32: Displaying the fields in the HPD:IncidentInterface_Create form ClearPass Extension for BMC Remedy - TechNote 30

31 Appendix A Additional Diagnostics and Support Checking on the Extension Service The ClearPass Extensions are supported by a new system service added in 6.6. This service must be running. Note: Restarting this service will affect all deployed and running extensions. To check on the state of the Extension Service, or to restart the service, go to Administration > Server Manager > Server Configuration > [SERVER] > Service Control. By default this service is automatically started. Figure 33: Services Control Extension Logs/Debugging If you have a requirement to access and view the logs from the Extension, you can turn on different logging levels from the API Explorer. It s just a matter of PUTting a new configuration to ClearPass. For example, the configuration below sets the loglevel to DEBUG. PUT this configuration using the API Explorer as shown below. Warning: Restarting the extension will cause an interruption in service whilst that restart occurs. { } "verifysslcerts": false, "loglevel": "DEBUG", "configs": [ { "localprefix": "/bmc", "authtype": "JWT", "JWT": { "tokenendpoint": " "apiendpoint": " "customauthmethod" : "AR-JWT", "authparams" : { "username": "apiuser", "password": "password" } } } ] ClearPass Extension for BMC Remedy - TechNote 31

32 Figure 34: Setting debug logging on After the Extension has been configured to capture logs the process to accessing them is described below. Use the API Explorer to view debug logs in the extension. Figure 35: Getting Logs out of an extension ClearPass Extension for BMC Remedy - TechNote 32

33 Note: Turning on the timestamps in the logs can be performed by flipping the timestamps option and limit the number of logs returned to say the last 100 rather than all logs by specifying a number in the tail parameter, by default all logs are returned with no timestamps. Accessing the extension logs using Collect Logs system function In addition to viewing the logs as shown above, logs can also be collected and examined via the Policy Manager Collect Logs system function (Administration > Server Manager > Server Configuration > [Select SERVER] > Collect Logs). This is extremely useful should you have a need to call for technical assistance. If the support team needs to investigate a system issue, one of the items they regularly ask for is the system logs to aid with their diagnostic investigation. By default the loglevel is set to INFO, but TRACE, DEBUG, INFO, WARN, ERROR, FATAL can also be set as required. Any of the levels will display the information for the selected state and lower; if INFO is selected, it will show messages for INFO, WARN, ERROR, FATAL. Warning: Once the process of identifying an issue through the system logging, its strongly suggested you return the logging to its default setting. After the logs have been collected, downloaded and expanded, you can locate the extension logs in the following location in the folder structure PolicyManagerLogs > extension > your-extension-id as shown below. Figure 36: Locating the Extension logs from 'Collect Logs' diagnostic GZ file ClearPass Extension for BMC Remedy - TechNote 33

34 Appendix B Considerations for Installing in a Cluster All previous information in this TechNote applies to a single ClearPass node (publisher-only) deployment. When installing the extension subscriber nodes within a cluster, there are a couple of things that need to be considered. Extension Installation Procedure for a Subscriber When you install an extension on a subscriber, the workflow is a slightly different as there is no process to configure API Clients, generate OAuth2 Access Tokens, etc., as all configuration is performed on the Publisher. To install an extension on a subscriber still requires that you use the API Explorer REST interface to install the extension, and to use the API Explorer requires that you have an OAuth2 Access Token. The problem is that on the subscriber node there is no option to generate the Access Token, as shown below. Figure 37: Subscriber with no "Generate Key" option Note: The solution to the issue is to use the API client on the Publisher to generate an Oauth2 Access Token, then COPY the HTTP Authorization key and use it on the Subscriber. Ensure you copy the Bearer portion of the key. ClearPass Extension for BMC Remedy - TechNote 34

35 Figure 38: Generate API Key in Publisher and copy it After you have copied the OAuth2 Access Token from the Publisher, go directly to the URL on the subscriber. Note: Ensure you enter the Authorization Header in the API Explorer before using trying to use the functions. Figure 39: Entering the HTTP Authorization key into the Subscriber Extension IDs in a Cluster Note that the store-id never changes and is specific to a published version of the extension. The Extension ID refers to the ID of an installed extension on a node. Installing an extension on five subscriber nodes would result in different Extension ID on every node. ClearPass Extension for BMC Remedy - TechNote 35