Security

Dear Experts, 

Question is regarding CPPM Onboard module. The scenario is simple, when the user is authenticated from Active Directory and is onboarded (given certificate by CPPM as root CA) what happens to the future authentication requests from the same user. Since he is now being authenticated with certificate, does this authentication involves AD also everytime. Customer wants to know that if AD is down for maintenance (and for query's sake, there is no AD backup etc), will the users still be allowed to authenticate using certificates only?

I know you may say they will not be able to login to their machines but i just want to give answer to the query they have asked. They need to know that once certificate based authentication is used, does it still authenticates with AD in the background?

Once device is onborded it uses certificates to authenticate until certificate is valid or someone revoke the certificate.

We can use AD as Authorization source for certificate comparison in EAP-TLS protocol, if you are not using as Authorization source then it will use only certificates.

Create a copy of the original EAP-TLS method. Remove the authorization check from the copy.  Use copy method in your radius service.