topic Re: CloudPath SaaS EAP-TLS computer authentication in Cloudpath Enrollment System (ES)

CloudPath SaaS EAP-TLS computer authentication

vadim_matusovsk — Fri, 07 May 2021 16:27:07 GMT

Hello,

I have implemented an Unleashed solution with ICXs, R320s, and CloudPath SaaS.

We are a cloud native org, and using AAD as IDP for our applications.

We are using AAD with CloudPath utilizing SAML for integration and user authentication for onboarding to WiFi.

The process is simple, the user accesses the Cloudpath onbaording URL, gets redirected to AAD, authenticates, and downloads the app for the Certificate and WiFi configuration.

All our users are using Windows 10 devices.

I have noticed that when Windows boots up, it is not connecting to WiFi, after the user logs in, the WiFi connects.

I have investigated this, and found the the authentication is a user authentication, and this explains the behavior.

I would like to change the EAP-TLS to computer authentication, so that WiFi could connect before the user logs in.

Could you advise please ?

Thanks,

Vadim.

Re: CloudPath SaaS EAP-TLS computer authentication

christopher_moh — Mon, 10 May 2021 16:33:17 GMT

Hello Vadim,

You can modify how the certificate is installed on the device by opening up:

Configurations
Device Configurations
Select the Device Configuration that you want to edit by clicking the disclosure triangle to the left of it
Click on the OS Settings Tab
The first entry is for "Windows Settings"
Click the Pencil beside "Configuration from the Network(s) and Trust tabsConfiguration from the Network(s) and Trust tabs" in the Windows Settings table
In the Advanced menu, you can modify WLAN and Certificates for User/Machine.

Regards,

Christopher

Re: CloudPath SaaS EAP-TLS computer authentication

pierce_larsen — Wed, 12 May 2021 19:39:04 GMT

Vadim,

You can change this in your device configuration. In Cloudpath admin UI, go to Configuration-->OS settings-->Windows-->Click Pencil by Configuration from the Network(s)-->Change WLAN Profile Type and Certificate Store to "Machine" and "Machine"-->Change Authentication Mode to "Machine Only"

If Authentication Mode isn't set to "Machine Only" then either it won't work pre-login or post-login with no user cert.

If you change to the settings I highlighted above, then it should work both pre and post login using the machine certificate.

Thanks,

Pierce

Re: CloudPath SaaS EAP-TLS computer authentication

vadim_matusovsk — Tue, 16 Nov 2021 14:01:50 GMT

Hi Pierce and Christopher,

Thank you for the reply and help!

If I'm changing to an already deployed configuration, will it affect the user that were already deployed with the User authentication ? Or it wont affect the already deployed, and only affect future deployed only with "Machine Only" ?

Thanks again,

Vadim.

Re: CloudPath SaaS EAP-TLS computer authentication

vadim_matusovsk — Sun, 05 Dec 2021 17:07:44 GMT

Hey,

Any advise ?

Thanks,

Vadim.

Re: CloudPath SaaS EAP-TLS computer authentication

christopher_moh — Sun, 05 Dec 2021 19:56:45 GMT

Hello Vadim,

It should not affect any existing certificates by making that change, since this is how the certificate is stored on that local machine, so it will only affect new deployments.

Regards,

Christopher

Re: CloudPath SaaS EAP-TLS computer authentication

vadim_matusovsk — Wed, 15 Dec 2021 07:40:10 GMT

Thanks! I will try this.

Re: CloudPath SaaS EAP-TLS computer authentication

vadim_matusovsk — Thu, 16 Dec 2021 16:08:11 GMT

Hi,

Changed to Machine but still the certificate installed under the user store.

If I export the certs from the user store, and import the computer store it does auth pre-login.

Any advise ?

Thanks,

Vadim.

Re: CloudPath SaaS EAP-TLS computer authentication

vadim_matusovsk — Wed, 12 Jan 2022 09:55:29 GMT

@christopher_mohammed Hey, any advise on the above ?

Thanks,

Re: CloudPath SaaS EAP-TLS computer authentication

pierce_larsen — Wed, 12 Jan 2022 15:02:06 GMT

@vadim_matusovsky if you change all 3 settings to "Machine/Machine/Machine Only", and publish a snapshot. The cert should then be installed in the Machine store, and if we connect to the WLAN using "Machine Only" as the auth type, this will work both pre and post login. We shouldn't need to do any export if we make the necessary config changes, publish a snapshot, then re-enroll the device. See attached screenshots.

Re: CloudPath SaaS EAP-TLS computer authentication

pierce_larsen — Mon, 17 Jan 2022 22:46:26 GMT

@vadim_matusovsky Let us know if you still have any questions.

Thanks,

Pierce