Sophos XG STAS / Client Authentication / macOS

[ngranville]

Hello, We use Sophos XG and our Windows clients happily authenticate using STAS. Does anyone know if this works or another SSO possibility exists for macOS? I have also tried pushing the Client Authentication Agent to macOS and having it start but this does not seem to have any sort of SSO and users need to authenticate maually here?

Very interested to hear how others have resolved or worked around this scenario?

Nick

[EddyAllen]

You could pass the login credentials to RADIUS and use that for SSO. Its not pretty but its proved pretty solid for mobile devices; user logs in using normal credentials to the WiFi SSID which gets sent to Windows NPAS sitting on a DC which then uses the SophosXG as the accounting server.

[ngranville]

Thanks, will certainly think about that but ideally I want to just pass the AD login along. I think the native macOS AD client does not work like a windows box.

[Jamman960]

Stas detects logins via the ad server audit logs so if the Macs are authenticating to AD they might still get picked up

[mrnoisy]

Stas detects logins via the ad server audit logs so if the Macs are authenticating to AD they might still get picked up

 

That’s how we have ours setup with 150 shared iMacs, works. Although our stas is flakey at best, so looking for alternatives.

[EddyAllen]

That’s how we have ours setup with 150 shared iMacs, works. Although our stas is flakey at best, so looking for alternatives.

 

Yeah I'll admit stas isn't terribly reliable and the login / logoff detection isn't great. I've had users signed in where its still got restrictions based on the previous user. RADIUS I've found to be much more reliable.