7.2.1. Plugin Type

There are two different types of plugins:

  • Synchronous: These plugins will be execute with an authentication process and modify the results of policy evaluation. The synchronous plugins have been named with Sync ending.

These plugins are executed with the poleval while the device is on the authentication process and allows to change some device parameters. Otherwise, the asynchronous plugins are executed to complement information or execute other functions when the device is already authenticated.

  • Asynchronous: These plugins are executed using workers. They will be executed independently of the authentication process to get more information about assets. The results of plugin execution will not modify the policy evaluation.

7.2.1.1. Asynchronous

The execution of an event will trigger the execution of this Plugin, but it will not wait for the Plugin to finish its execution. It means that the Plugin is executed in the background, and the event can be completed whether the Plugin has finished or not.

E.g: OpenNAC Enterprise receives an 802.1x authentication. OpenNAC Enterprise completes the authentication while the Plugin is being executed in the background. If the plugin execution changes the authentication result, a reevaluation will be made for that event.

802.1x auth with asynchronous plugin execution example

../../_images/asynchronous.png


When the plugin is executed correctly, it will add a specific tag in the format of PLE<plugin_name>. For example, if the Discover plugin is executed correctly, it will add the PLE_DISCOVER tag along with other relevant tags that provide information about the scanned data.

7.2.1.2. Synchronous

The execution of an event that depends on this plugin will not continue until the plugin has finished. In other words, the code is executed sequentially, the next part of the execution does not start until the previous has finished.

Warning

  • The execution of these plugins must be fast. Otherwise, the authentication process will be delayed which will affect the overall OpenNAC execution.

  • Be careful with third parties such as making a CURL to an API. Set timeouts to exit the execution if there is no answer.

E.g: OpenNAC Enterprise receives a 802.1x authentication. We cannot assign a VLAN until the Plugin configured has finished. If the execution of the plugin takes 5 seconds, the authentication will wait 5 seconds. Once the Plugin has finished, OpenNAC Enterprise is able to complete the authentication. In this case, the Plugin information could vary the authentication result.

802.1x auth with synchronous plugin execution example

../../_images/synchronous.png