Security

Dear Experts,

I am not an AD expert so please bear with me. One of my customer is trying to join CPPM (6.10) to AD. They want to do it via using username@domain path coz according to them their domain controller is supporting multiple domains and he has the admin account of domain1 only. So he needs to enter something like username@domain1.pk. This is how they integrated their Cisco CUCM with their AD also. 

Any idea if its possible?

You should not need to join Active Directory, unless you need MSCHAPv2 authentication which is deprecated and should be replaced by EAP-TLS or TEAP. The AD join is also only for authentication, and I can imagine that if the domains are fully trusted you can lookup passwords for users in the other domain as well.

This topic is too complex, with too many parameters to discuss in a forum. It would be needed to better understand what you try to achieve, authentication methods, policies, network/AD topology, to come to a full design. Working with someone who does understand AD may help, as it may just work, but if you deploy something that is insecure based of that, it's not in anyone's benefit either.

Dear Experts,

I am not an AD expert so please bear with me. One of my customer is trying to join CPPM (6.10) to AD. They want to do it via using username@domain path coz according to them their domain controller is supporting multiple domains and he has the admin account of domain1 only. So he needs to enter something like username@domain1.pk. This is how they integrated their Cisco CUCM with their AD also. 

Any idea if its possible?

You should not need to join Active Directory, unless you need MSCHAPv2 authentication which is deprecated and should be replaced by EAP-TLS or TEAP. The AD join is also only for authentication, and I can imagine that if the domains are fully trusted you can lookup passwords for users in the other domain as well.

This topic is too complex, with too many parameters to discuss in a forum. It would be needed to better understand what you try to achieve, authentication methods, policies, network/AD topology, to come to a full design. Working with someone who does understand AD may help, as it may just work, but if you deploy something that is insecure based of that, it's not in anyone's benefit either.

Dear Experts,

I am not an AD expert so please bear with me. One of my customer is trying to join CPPM (6.10) to AD. They want to do it via using username@domain path coz according to them their domain controller is supporting multiple domains and he has the admin account of domain1 only. So he needs to enter something like username@domain1.pk. This is how they integrated their Cisco CUCM with their AD also. 

Any idea if its possible?

For MSCHAPv2, and access to the password for the user, that is what the domain join is needed for. That access to the password for the user is also exactly the reason why you shouldn't use password authentication for 802.1X. If your customer wants password authentication, you should point them to the fact that they are likely to deploy something that is insecure.

TEAP can use MSCHAPv2 as well, but it's much harder to configure it wrong, but TEAP with MSCHAPv2 requires the AD join as well.

As said, it may be that it just works for the MSCHAPv2 if domains are fully trusted and you join to one of them, but I don't know because it's deprecated for years and I would not suggest doing it at all.

You should not need to join Active Directory, unless you need MSCHAPv2 authentication which is deprecated and should be replaced by EAP-TLS or TEAP. The AD join is also only for authentication, and I can imagine that if the domains are fully trusted you can lookup passwords for users in the other domain as well.

This topic is too complex, with too many parameters to discuss in a forum. It would be needed to better understand what you try to achieve, authentication methods, policies, network/AD topology, to come to a full design. Working with someone who does understand AD may help, as it may just work, but if you deploy something that is insecure based of that, it's not in anyone's benefit either.

Dear Experts,

I am not an AD expert so please bear with me. One of my customer is trying to join CPPM (6.10) to AD. They want to do it via using username@domain path coz according to them their domain controller is supporting multiple domains and he has the admin account of domain1 only. So he needs to enter something like username@domain1.pk. This is how they integrated their Cisco CUCM with their AD also. 

Any idea if its possible?

For MSCHAPv2, and access to the password for the user, that is what the domain join is needed for. That access to the password for the user is also exactly the reason why you shouldn't use password authentication for 802.1X. If your customer wants password authentication, you should point them to the fact that they are likely to deploy something that is insecure.

TEAP can use MSCHAPv2 as well, but it's much harder to configure it wrong, but TEAP with MSCHAPv2 requires the AD join as well.

As said, it may be that it just works for the MSCHAPv2 if domains are fully trusted and you join to one of them, but I don't know because it's deprecated for years and I would not suggest doing it at all.

You should not need to join Active Directory, unless you need MSCHAPv2 authentication which is deprecated and should be replaced by EAP-TLS or TEAP. The AD join is also only for authentication, and I can imagine that if the domains are fully trusted you can lookup passwords for users in the other domain as well.

This topic is too complex, with too many parameters to discuss in a forum. It would be needed to better understand what you try to achieve, authentication methods, policies, network/AD topology, to come to a full design. Working with someone who does understand AD may help, as it may just work, but if you deploy something that is insecure based of that, it's not in anyone's benefit either.

Dear Experts,

I am not an AD expert so please bear with me. One of my customer is trying to join CPPM (6.10) to AD. They want to do it via using username@domain path coz according to them their domain controller is supporting multiple domains and he has the admin account of domain1 only. So he needs to enter something like username@domain1.pk. This is how they integrated their Cisco CUCM with their AD also. 

Any idea if its possible?

For managed devices, Active Directory Group Policies or Mobile Device Management is widely used to enroll client certificates to your clients. Onboard is designed for unmanaged clients, like contractors or BYOD.

For MSCHAPv2, and access to the password for the user, that is what the domain join is needed for. That access to the password for the user is also exactly the reason why you shouldn't use password authentication for 802.1X. If your customer wants password authentication, you should point them to the fact that they are likely to deploy something that is insecure.

TEAP can use MSCHAPv2 as well, but it's much harder to configure it wrong, but TEAP with MSCHAPv2 requires the AD join as well.

As said, it may be that it just works for the MSCHAPv2 if domains are fully trusted and you join to one of them, but I don't know because it's deprecated for years and I would not suggest doing it at all.

You should not need to join Active Directory, unless you need MSCHAPv2 authentication which is deprecated and should be replaced by EAP-TLS or TEAP. The AD join is also only for authentication, and I can imagine that if the domains are fully trusted you can lookup passwords for users in the other domain as well.

This topic is too complex, with too many parameters to discuss in a forum. It would be needed to better understand what you try to achieve, authentication methods, policies, network/AD topology, to come to a full design. Working with someone who does understand AD may help, as it may just work, but if you deploy something that is insecure based of that, it's not in anyone's benefit either.

Dear Experts,

I am not an AD expert so please bear with me. One of my customer is trying to join CPPM (6.10) to AD. They want to do it via using username@domain path coz according to them their domain controller is supporting multiple domains and he has the admin account of domain1 only. So he needs to enter something like username@domain1.pk. This is how they integrated their Cisco CUCM with their AD also. 

Any idea if its possible?

For managed devices, Active Directory Group Policies or Mobile Device Management is widely used to enroll client certificates to your clients. Onboard is designed for unmanaged clients, like contractors or BYOD.

For MSCHAPv2, and access to the password for the user, that is what the domain join is needed for. That access to the password for the user is also exactly the reason why you shouldn't use password authentication for 802.1X. If your customer wants password authentication, you should point them to the fact that they are likely to deploy something that is insecure.

TEAP can use MSCHAPv2 as well, but it's much harder to configure it wrong, but TEAP with MSCHAPv2 requires the AD join as well.

As said, it may be that it just works for the MSCHAPv2 if domains are fully trusted and you join to one of them, but I don't know because it's deprecated for years and I would not suggest doing it at all.

You should not need to join Active Directory, unless you need MSCHAPv2 authentication which is deprecated and should be replaced by EAP-TLS or TEAP. The AD join is also only for authentication, and I can imagine that if the domains are fully trusted you can lookup passwords for users in the other domain as well.

This topic is too complex, with too many parameters to discuss in a forum. It would be needed to better understand what you try to achieve, authentication methods, policies, network/AD topology, to come to a full design. Working with someone who does understand AD may help, as it may just work, but if you deploy something that is insecure based of that, it's not in anyone's benefit either.

Dear Experts,

I am not an AD expert so please bear with me. One of my customer is trying to join CPPM (6.10) to AD. They want to do it via using username@domain path coz according to them their domain controller is supporting multiple domains and he has the admin account of domain1 only. So he needs to enter something like username@domain1.pk. This is how they integrated their Cisco CUCM with their AD also. 

Any idea if its possible?

Are these devices under some sort of device management?

If so, probably best to use that.

If not managed, ClearPass Onboard or similar tool would be the most recommended solution.

For managed devices, Active Directory Group Policies or Mobile Device Management is widely used to enroll client certificates to your clients. Onboard is designed for unmanaged clients, like contractors or BYOD.

For MSCHAPv2, and access to the password for the user, that is what the domain join is needed for. That access to the password for the user is also exactly the reason why you shouldn't use password authentication for 802.1X. If your customer wants password authentication, you should point them to the fact that they are likely to deploy something that is insecure.

TEAP can use MSCHAPv2 as well, but it's much harder to configure it wrong, but TEAP with MSCHAPv2 requires the AD join as well.

As said, it may be that it just works for the MSCHAPv2 if domains are fully trusted and you join to one of them, but I don't know because it's deprecated for years and I would not suggest doing it at all.

You should not need to join Active Directory, unless you need MSCHAPv2 authentication which is deprecated and should be replaced by EAP-TLS or TEAP. The AD join is also only for authentication, and I can imagine that if the domains are fully trusted you can lookup passwords for users in the other domain as well.

This topic is too complex, with too many parameters to discuss in a forum. It would be needed to better understand what you try to achieve, authentication methods, policies, network/AD topology, to come to a full design. Working with someone who does understand AD may help, as it may just work, but if you deploy something that is insecure based of that, it's not in anyone's benefit either.

Dear Experts,

I am not an AD expert so please bear with me. One of my customer is trying to join CPPM (6.10) to AD. They want to do it via using username@domain path coz according to them their domain controller is supporting multiple domains and he has the admin account of domain1 only. So he needs to enter something like username@domain1.pk. This is how they integrated their Cisco CUCM with their AD also. 

Any idea if its possible?

Are these devices under some sort of device management?

If so, probably best to use that.

If not managed, ClearPass Onboard or similar tool would be the most recommended solution.

For managed devices, Active Directory Group Policies or Mobile Device Management is widely used to enroll client certificates to your clients. Onboard is designed for unmanaged clients, like contractors or BYOD.

For MSCHAPv2, and access to the password for the user, that is what the domain join is needed for. That access to the password for the user is also exactly the reason why you shouldn't use password authentication for 802.1X. If your customer wants password authentication, you should point them to the fact that they are likely to deploy something that is insecure.

TEAP can use MSCHAPv2 as well, but it's much harder to configure it wrong, but TEAP with MSCHAPv2 requires the AD join as well.

As said, it may be that it just works for the MSCHAPv2 if domains are fully trusted and you join to one of them, but I don't know because it's deprecated for years and I would not suggest doing it at all.

You should not need to join Active Directory, unless you need MSCHAPv2 authentication which is deprecated and should be replaced by EAP-TLS or TEAP. The AD join is also only for authentication, and I can imagine that if the domains are fully trusted you can lookup passwords for users in the other domain as well.

This topic is too complex, with too many parameters to discuss in a forum. It would be needed to better understand what you try to achieve, authentication methods, policies, network/AD topology, to come to a full design. Working with someone who does understand AD may help, as it may just work, but if you deploy something that is insecure based of that, it's not in anyone's benefit either.

Dear Experts,

I am not an AD expert so please bear with me. One of my customer is trying to join CPPM (6.10) to AD. They want to do it via using username@domain path coz according to them their domain controller is supporting multiple domains and he has the admin account of domain1 only. So he needs to enter something like username@domain1.pk. This is how they integrated their Cisco CUCM with their AD also. 

Any idea if its possible?

For MSCHAPv2, and access to the password for the user, that is what the domain join is needed for. That access to the password for the user is also exactly the reason why you shouldn't use password authentication for 802.1X. If your customer wants password authentication, you should point them to the fact that they are likely to deploy something that is insecure.

TEAP can use MSCHAPv2 as well, but it's much harder to configure it wrong, but TEAP with MSCHAPv2 requires the AD join as well.

As said, it may be that it just works for the MSCHAPv2 if domains are fully trusted and you join to one of them, but I don't know because it's deprecated for years and I would not suggest doing it at all.

You should not need to join Active Directory, unless you need MSCHAPv2 authentication which is deprecated and should be replaced by EAP-TLS or TEAP. The AD join is also only for authentication, and I can imagine that if the domains are fully trusted you can lookup passwords for users in the other domain as well.

This topic is too complex, with too many parameters to discuss in a forum. It would be needed to better understand what you try to achieve, authentication methods, policies, network/AD topology, to come to a full design. Working with someone who does understand AD may help, as it may just work, but if you deploy something that is insecure based of that, it's not in anyone's benefit either.

Dear Experts,

I am not an AD expert so please bear with me. One of my customer is trying to join CPPM (6.10) to AD. They want to do it via using username@domain path coz according to them their domain controller is supporting multiple domains and he has the admin account of domain1 only. So he needs to enter something like username@domain1.pk. This is how they integrated their Cisco CUCM with their AD also. 

Any idea if its possible?

Also when we go to AD join window, there is this warning mentioned. I tried searching on google but no trace of it. Any idea what does it mean

Best Regards

Owais Iqbal

CCIE#37956 | ACDX 

Technical Consultant - Aruba Networks

Mob/Whatsapp: +92-321-2960496

For MSCHAPv2, and access to the password for the user, that is what the domain join is needed for. That access to the password for the user is also exactly the reason why you shouldn't use password authentication for 802.1X. If your customer wants password authentication, you should point them to the fact that they are likely to deploy something that is insecure.

TEAP can use MSCHAPv2 as well, but it's much harder to configure it wrong, but TEAP with MSCHAPv2 requires the AD join as well.

As said, it may be that it just works for the MSCHAPv2 if domains are fully trusted and you join to one of them, but I don't know because it's deprecated for years and I would not suggest doing it at all.

You should not need to join Active Directory, unless you need MSCHAPv2 authentication which is deprecated and should be replaced by EAP-TLS or TEAP. The AD join is also only for authentication, and I can imagine that if the domains are fully trusted you can lookup passwords for users in the other domain as well.

This topic is too complex, with too many parameters to discuss in a forum. It would be needed to better understand what you try to achieve, authentication methods, policies, network/AD topology, to come to a full design. Working with someone who does understand AD may help, as it may just work, but if you deploy something that is insecure based of that, it's not in anyone's benefit either.

Dear Experts,

I am not an AD expert so please bear with me. One of my customer is trying to join CPPM (6.10) to AD. They want to do it via using username@domain path coz according to them their domain controller is supporting multiple domains and he has the admin account of domain1 only. So he needs to enter something like username@domain1.pk. This is how they integrated their Cisco CUCM with their AD also. 

Any idea if its possible?