Security

Hi All,

Is certificate-based authentication in ClearPass possible without against any LDAP-compliant directory,  i.e. client certificate is validated with the Trusted CA cert chain installed in ClearPass.

Thanks

Look at the EAP-TLS auth method, one of the checkboxes is "Authorization Required".  Copy the auth method, uncheck that box, no lookup of the certificate subject is then required for the authentication to succeed.  Later authorization checks can further determine validity of the auth request and enforcement.

------------------------------
Carson Hulcher, ACEX#110

Original Message:
Sent: Jul 31, 2024 09:31 AM
From: harutyun.hakobyan
Subject: ClearPass certificate-based authentications

Hi All,

Is certificate-based authentication in ClearPass possible without against any LDAP-compliant directory,  i.e. client certificate is validated with the Trusted CA cert chain installed in ClearPass.

Thanks

Thanks for reply.

For authorization Microsoft Entra ID will be used, but that can't be used for authentication.

From EAP-TLS method if "Authorization Required" is unchecked and we want authentication only via certificates without local Active Directory, is it possible? 

ClearPass version is the latest: 6.12.2.

Original Message:
Sent: Jul 31, 2024 01:01 PM
From: chulcher
Subject: ClearPass certificate-based authentications

Look at the EAP-TLS auth method, one of the checkboxes is "Authorization Required".  Copy the auth method, uncheck that box, no lookup of the certificate subject is then required for the authentication to succeed.  Later authorization checks can further determine validity of the auth request and enforcement.

------------------------------
Carson Hulcher, ACEX#110

Original Message:
Sent: Jul 31, 2024 09:31 AM
From: harutyun.hakobyan
Subject: ClearPass certificate-based authentications

Hi All,

Is certificate-based authentication in ClearPass possible without against any LDAP-compliant directory,  i.e. client certificate is validated with the Trusted CA cert chain installed in ClearPass.

Thanks

Yes. What 'Authorization' in the EAP-TLS method does, is verify if the user that authenticates exist in the Authentication Source.

If you disable Authorization, any valid certificate (against the trust list) is accepted. In your role mapping and enforcement, you can further limit down like with a lookup to Intune or Entra ID, or limit to specific certificate authorities only.

Thanks for reply.

For authorization Microsoft Entra ID will be used, but that can't be used for authentication.

From EAP-TLS method if "Authorization Required" is unchecked and we want authentication only via certificates without local Active Directory, is it possible? 

ClearPass version is the latest: 6.12.2.

Original Message:
Sent: Jul 31, 2024 01:01 PM
From: chulcher
Subject: ClearPass certificate-based authentications

Look at the EAP-TLS auth method, one of the checkboxes is "Authorization Required".  Copy the auth method, uncheck that box, no lookup of the certificate subject is then required for the authentication to succeed.  Later authorization checks can further determine validity of the auth request and enforcement.

------------------------------
Carson Hulcher, ACEX#110

Original Message:
Sent: Jul 31, 2024 09:31 AM
From: harutyun.hakobyan
Subject: ClearPass certificate-based authentications

Hi All,

Is certificate-based authentication in ClearPass possible without against any LDAP-compliant directory,  i.e. client certificate is validated with the Trusted CA cert chain installed in ClearPass.

Thanks

So for Authentication methods put modified EAP-TLS with unchecked "Authorization Required" option.

What do put for Authentication Sources ?

Yes. What 'Authorization' in the EAP-TLS method does, is verify if the user that authenticates exist in the Authentication Source.

If you disable Authorization, any valid certificate (against the trust list) is accepted. In your role mapping and enforcement, you can further limit down like with a lookup to Intune or Entra ID, or limit to specific certificate authorities only.

Thanks for reply.

For authorization Microsoft Entra ID will be used, but that can't be used for authentication.

From EAP-TLS method if "Authorization Required" is unchecked and we want authentication only via certificates without local Active Directory, is it possible? 

ClearPass version is the latest: 6.12.2.

Original Message:
Sent: Jul 31, 2024 01:01 PM
From: chulcher
Subject: ClearPass certificate-based authentications

Look at the EAP-TLS auth method, one of the checkboxes is "Authorization Required".  Copy the auth method, uncheck that box, no lookup of the certificate subject is then required for the authentication to succeed.  Later authorization checks can further determine validity of the auth request and enforcement.

------------------------------
Carson Hulcher, ACEX#110

Original Message:
Sent: Jul 31, 2024 09:31 AM
From: harutyun.hakobyan
Subject: ClearPass certificate-based authentications

Hi All,

Is certificate-based authentication in ClearPass possible without against any LDAP-compliant directory,  i.e. client certificate is validated with the Trusted CA cert chain installed in ClearPass.

Thanks

So for Authentication methods put modified EAP-TLS with unchecked "Authorization Required" option.

What do put for Authentication Sources ?

Yes. What 'Authorization' in the EAP-TLS method does, is verify if the user that authenticates exist in the Authentication Source.

If you disable Authorization, any valid certificate (against the trust list) is accepted. In your role mapping and enforcement, you can further limit down like with a lookup to Intune or Entra ID, or limit to specific certificate authorities only.

Thanks for reply.

For authorization Microsoft Entra ID will be used, but that can't be used for authentication.

From EAP-TLS method if "Authorization Required" is unchecked and we want authentication only via certificates without local Active Directory, is it possible? 

ClearPass version is the latest: 6.12.2.

Original Message:
Sent: Jul 31, 2024 01:01 PM
From: chulcher
Subject: ClearPass certificate-based authentications

Look at the EAP-TLS auth method, one of the checkboxes is "Authorization Required".  Copy the auth method, uncheck that box, no lookup of the certificate subject is then required for the authentication to succeed.  Later authorization checks can further determine validity of the auth request and enforcement.

------------------------------
Carson Hulcher, ACEX#110

Original Message:
Sent: Jul 31, 2024 09:31 AM
From: harutyun.hakobyan
Subject: ClearPass certificate-based authentications

Hi All,

Is certificate-based authentication in ClearPass possible without against any LDAP-compliant directory,  i.e. client certificate is validated with the Trusted CA cert chain installed in ClearPass.

Thanks