Security

last person joined: 21 hours ago 

Forum to discuss Enterprise security using HPE Aruba Networking NAC solutions (ClearPass), Introspect, VIA, 360 Security Exchange, Extensions, and Policy Enforcement Firewall (PEF).
Back to discussions
Expand all | Collapse all

Macbook, domain joined, pre-logon 802.1x authentication

This thread has been viewed 1 times

  • 1.  Macbook, domain joined, pre-logon 802.1x authentication

    Posted Mar 09, 2017 01:22 PM

    I am not 100% certain how to even search for this information, and my local var doesn't have a great answer for me.

     

    How can I get a domain joined Mac to authenticate prior to login? Our problem happens when a user has a password expire, they can no longer connect to the wireless.

     

    On our windows side, we use a policy that allows the computer to authenticate using the computer record, which allows it to be connected to allow the user to logon/change expired password.

    Really, I just want to know what my options here are. How do we get a pre-login type account setup? I understand there used to be a way with configurator, but we can't seem to replicate. We run many different versions of OSX in our enviornment. Approximately 5000 Macs, all joined to our domain.

    Ideally we would like a 1-size fits all method, but we are not against doing it a more challenging way for the sake of reliable connectivity. Originally our var suggested we might be able to generate a cert and use that for connecting the Macs, but we want to be able to tie the authentication, once a user is logged in, to the user. (Computers exchange hands faster than we can keep up, we are a school district and assets are transferred randomly.) If this is not possible, then we need a method to at least identify differing computers.


    We run 6.5.0.3 on a Master/Local setup.
    We have Clearpass 6.6.2
    Running AP 315/314



  • 2.  RE: Macbook, domain joined, pre-logon 802.1x authentication

    EMPLOYEE
    Posted Mar 09, 2017 01:42 PM

    You'd want to use a log in window profile.

     

    Screen_Shot_2017-03-09_at_1_40_33_PM.jpg



  • 3.  RE: Macbook, domain joined, pre-logon 802.1x authentication

    Posted Mar 09, 2017 02:15 PM

    Does that work prior to the user logging in? Is it passing their user credentials or the computer?  both?



  • 4.  RE: Macbook, domain joined, pre-logon 802.1x authentication

    EMPLOYEE
    Posted Mar 09, 2017 02:16 PM
    Yes, the user’s credentials will be passed to the network first, then to the authenticating domain controller.


  • 5.  RE: Macbook, domain joined, pre-logon 802.1x authentication

    Posted Mar 09, 2017 02:43 PM

    Can is pass computer account? I am worried about relying on user crednetials because when a password expires, they are no longer able to connect to wifi, so they are not able to change their password. (without hardwire)



  • 6.  RE: Macbook, domain joined, pre-logon 802.1x authentication
    Best Answer

    EMPLOYEE
    Posted Mar 09, 2017 02:45 PM
    Yes, but you’d lose the user identity.

    You could try using both system and user level configuration profiles, but it’s not something I’ve had a chance to test.


  • 7.  RE: Macbook, domain joined, pre-logon 802.1x authentication

    Posted Mar 09, 2017 02:52 PM

    I'll give it a shot. I think between you (cappalli) and cjoseph I got some information to go on. I think it might be all that is needed to make this work.



  • 8.  RE: Macbook, domain joined, pre-logon 802.1x authentication

    Posted Sep 30, 2017 08:53 AM

    Hi,

     

    Have you had any luck with this as yet. I'm very keen to bring our Macs inline with our windows PC's in terms of pre-logon wireless connectivity and authentication via machine as opposed to account name.

     

    Rich



  • 9.  RE: Macbook, domain joined, pre-logon 802.1x authentication

    EMPLOYEE
    Posted Sep 30, 2017 10:10 AM
    You can't do machine + user, but machine auth only is possible by sending a configuration profile down from your EMM solution.


  • 10.  RE: Macbook, domain joined, pre-logon 802.1x authentication

    Posted Nov 11, 2019 02:07 AM

    Hi,

     

    I have to login AD user on 802.1x Wireless Network.

    Its showing Network Service not available.

     

    Please help me to get solution.

     

    Please provide detail step to solve the issue

     

     

     

     



  • 11.  RE: Macbook, domain joined, pre-logon 802.1x authentication

    EMPLOYEE
    Posted Nov 11, 2019 03:19 AM

    This thread is two years old and things have changed considerably.  Please open a new thread with your detailed question.



  • 12.  RE: Macbook, domain joined, pre-logon 802.1x authentication

    EMPLOYEE
    Posted Mar 09, 2017 02:22 PM
    @irkednet wrote:

    I am not 100% certain how to even search for this information, and my local var doesn't have a great answer for me.

     

    How can I get a domain joined Mac to authenticate prior to login? Our problem happens when a user has a password expire, they can no longer connect to the wireless.

     

    On our windows side, we use a policy that allows the computer to authenticate using the computer record, which allows it to be connected to allow the user to logon/change expired password.

    Really, I just want to know what my options here are. How do we get a pre-login type account setup? I understand there used to be a way with configurator, but we can't seem to replicate. We run many different versions of OSX in our enviornment. Approximately 5000 Macs, all joined to our domain.

    Ideally we would like a 1-size fits all method, but we are not against doing it a more challenging way for the sake of reliable connectivity. Originally our var suggested we might be able to generate a cert and use that for connecting the Macs, but we want to be able to tie the authentication, once a user is logged in, to the user. (Computers exchange hands faster than we can keep up, we are a school district and assets are transferred randomly.) If this is not possible, then we need a method to at least identify differing computers.


    We run 6.5.0.3 on a Master/Local setup.
    We have Clearpass 6.6.2
    Running AP 315/314

    Login Profile:  https://ntsystems.it/post/joining-wifi-before-login-on-mac-os-x-108