AuthHound

Aruba VSA · attr 1 · type string

Aruba-User-Role

Aruba-User-Role is a string VSA (vendor 14823, attribute 1) that puts a session into a named Aruba role. Like Filter-Id, it selects policy by name — the role has to exist on the controller.

Also searched as: Aruba-User-Role VSA, ClearPass role attribute. Defined in Aruba vendor dictionary (vendor 14823).

What it means

On ArubaOS and Aruba/HPE switches, the user role bundles the firewall policies, VLAN, and bandwidth rules for a session. Aruba-User-Role names which role to apply; the definition lives on the device, and RADIUS only sends the label. It's the Aruba-native equivalent of Cisco's downloadable/named policy and of the RFC Filter-Id.

How it's used

Return the exact role name configured on the controller. Pair it with an initial-role/enforcement setup so unauthenticated devices land somewhere safe before the role is applied.

Common gotchas

  • If the named role doesn't exist on the controller, the device falls to the default/initial role — often more or less access than intended, with no obvious error.
  • Role name matching is exact; a trailing space or case difference silently misses.

Prove what the server actually returned: the open-source authhound-probe prints every authorization attribute in the Access-Accept and asserts the one you care about — a silently ignored attribute becomes a hard FAIL. 

export AUTHHOUND_RADIUS_SECRET='shared-secret'   # not in argv or shell history
authhound-probe radius test --server radius.corp.com --peap alice --expect-attr Filter-Id=staff

Recipe: assert returned attributes with --expect-vlan / --expect-attr

Seeing this attribute in a reject or an accept that behaves wrong? Paste the full log into the analyzer — it runs in your browser, nothing is uploaded, and it ranks the likely causes for your specific output.

Related

When a NAS quietly stops honoring an attribute across a fleet, nobody sees it until users complain. AuthHound is building monitoring that tracks the attributes your servers actually return — early access:

No spam, no sharing — one email when it's ready, and you can reply to be removed anytime.