Switching from Device to User Certificate

[mitchell1981]

Hi All,

 

Trying to get my head around certificate based wireless connections. I've had it working for a while with device only certificates, but that doesn't work well with filtering by user.

 

I've got my PKI set up ok. Devices get a certificate, and users get a certificate when they log in.

I've set up Radius (NPS) to handle the authentication and this works fine also.

 

My problem is getting a laptop to switch from device based authentication to user based authentication when a user logs in.

 

I've tried 'Computer or User authentication' setting in the GPO (that seems to favour the user certificate and the device certificate never connects.

I've tried two separate settings on the same SSID. Again, the device based connection never seems to kick in.

I've tried two SSIDs, one for devices and one for users. They both work as expected, but the user one doesn't take over on login, even though it is the 'preferred' connection. If I toggle wifi on and off it will connect to the correct one.

 

Am I completely misunderstanding this process, or do most people not bother with this, and find other ways to authenticate filtering while using the device certificate?

[wright-fi]

The problem you have is that you can only login using user or device authentication, not both.

 

You would need to use EAP Chaining to do both simultaneously, but this is not support with Windows NPS.

[RLR]

We've had issues with this. Two things we came up with:

 

We have a fortigate firewall which would allow us to use FortiAuthenticator to auth users logging in. This came at large cost to auth users so we decided not to go with this although we might in the future.

 

The other thing we are experimenting at the moment is Fortigate Seamles SSO Outbound firewall authentication with Azure AD as a SAML IdP.

 

We have this setup and working but the main issue is shared devices. If a machine is authenticated with a user at login it doesn't log them out from the firewall when they sign out so I have setup a login script to run an invoke-webrequest to the logout url. This should mean when a user signs in the previous user is de-authed.