Security

 View Only
last person joined: 2 days ago 

Enterprise security using ClearPass Policy Management, ClearPass Security Exchange, IntroSpect, VIA, 360 Security Exchange, Extensions and Policy Enforcement Firewall (PEF).
Expand all | Collapse all

EAP-TLS Windows Client not using username - Can ClearPass check on CN

Jump to Best Answer
This thread has been viewed 22 times
  • 1.  EAP-TLS Windows Client not using username - Can ClearPass check on CN

    Posted Aug 15, 2022 07:06 AM

    I have an issue when doing Windows EAP-TLS on wired Auth - (Windows 10, OS-CX and CPPM) - the environment does NOT use the email as username which is different from most set-ups. Usernames are a 6 digits ID.

    The PC has Group Policy and a user cert, but when it authenticate it uses the email address as username - resulting in user not found.

    I have 2 options I think
    A: Its the PC determines whats sent in the EAP packet and therefore it must be changed on the PC. It can't be influenced by the switch or CPPM
    or
    B: Is there an option for ClearPass to look at the CN  = XXX of the user

    The cert on the machine is in the username,


  • 2.  RE: EAP-TLS Windows Client not using username - Can ClearPass check on CN

    Posted Aug 15, 2022 08:55 AM
    In your EAP-TLS method (Configuration » Authentication » Methods) select Certificate Comparison option and change to whatever field in the Certificate the username is.  Is the username within any field in that certificate though?  If not you have two options:
    • Have PKI admin add the username to a field in the certificate.
    • Change AD to use email for username.



  • 3.  RE: EAP-TLS Windows Client not using username - Can ClearPass check on CN
    Best Answer

    EMPLOYEE
    Posted Aug 17, 2022 04:48 AM
    Option C: Change the AD Query to search for the e-mail in AD: https://www.youtube.com/watch?v=5HD3-2APAUs

    ------------------------------
    Herman Robers
    ------------------------
    If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

    In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
    ------------------------------



  • 4.  RE: EAP-TLS Windows Client not using username - Can ClearPass check on CN

    Posted 29 days ago
    Thanks, this was what I needed to see