Android, Ipad authentication under windows domain environment

I’m really confused about the best practice to set up these devices in a 802.1x and Windows Domain network using ISE.
I had seen the Ipad download the ISE certificate the very first time the device is connected to the SSID. In Android device (Galaxy phone) I don’t see the device download certificate.
Testing with the Android device I was able to install the root CA certificate (a not easy procedure), then when the SSID is configured in the device I have the option to choice the root CA certificate.
Now if I don’t include the certificate in the SSID configuration, the device is able to connect with an Identity and Password only. If I include the certificate in the SSID configuration, the device ask for the certificate storage password if the option for use secure credentials is not enabled before.
How can I validate through the ISE the android device is using the certificate? Is it possible to set a rule in the ISE denying access if the device does not validate the certificate? I think EAP necesarity use certificates, but the Android device does not show anything.
I had read about provisioning and profiling the Android devices. I think the Network Setup Assistant available through Google Play is an easy procedure to install the root CA certificate. Am I Right?
The customer said it appears the certificate is being used to encrypt the username and password not for do the authentication itself. Reading about EAP functionality I believe it is right, I understand the EAP-MSCHAP actually creates a tunnel to passthrough the username and password. Right?
As the Ipad and Android devices are not in the windows domain, what should be expected when the password is expired? Customer Policy indicates users must change domain passwords every four months. In a Windows PC users receive warnings some days before the expiration but it appears nothing happen in non-domain devices. A co-worker told me the easy way is that when this happen the user should remove the SSID in the device and create it again. The customer does not like this behavior, so what should be a best practice work around?
I hope you can help me to clarify my doubts.
Regards.
Daniel Escalante

Client Provisioning for Android you can refer thease guides:
http://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Borderless_Networks/Unified_Access/BYOD_Design_Guide/BYOD_ISE.html#wp1024291
http://www.cisco.com/c/en/us/support/docs/wireless/5500-series-wireless-controllers/113606-byod-flexconnect-dg-000.html#anc10

Similar Messages

I've got a imac under windows domain, if I loggin as no movil account, I cannot do anything. Why?

I've got a imac under windows domain, if I loggin as no movil account, I cannot do anything. Why?
can anyone explain to me how no movil account work?
thank you

I've got a imac under windows domain, if I loggin as no movil account, I cannot do anything. Why?
can anyone explain to me how no movil account work?
thank you

Authenticating to Windows Domain for Printing

From my PowerBook, I'm trying to print to a printer in a Windows domain. I know how to connect and stuff, that is not the issue.
The issue is, when I first connected, it prompted me for my domain, domain ID & password. I entered the info and put a check mark in save password to keychain. But my fingers were too fast for my brain. I realized that I had made a typo but had pressed Enter already. And so, I can't print to that printer because it always denies my login.
I can't find where to edit my login info. I looked in the Keychain Access app but could not find the entry in there. Do you know how I can get the login box back to fix my login info?
Ron

I'm not sure what exactly fixed the problem.
Last night, I disconnected the printer from my pc and connected it to an external print server box that I borrowed. I was able to connect and print from my PowerBook.
I then reconnected the printer back to the pc (LPT1) and re-shared it. This time, in reconnecting the PowerBook to the printer, the login dialogue box reappeared and so my problem is fixed.
I would guess that the deletion of the initial share and re-sharing the printer forced the login box to come back. However, I'm not 100% percent sure.
Ron

Flash CS4 Windows domain not supported

Do you know if it is true that Flash CS4 is not supported by Adobe on a Windows domain environment?
I don't understand why having a computer on a windows domain can cause Flash crashes constantly.
I'm trying to find documentation regarding my question, but haven't been able to find anything.

Hi kglad,
I am a bit new to this and can not find any info on allowscriptaccess.
Also most exe files that I have found are 2-3MB and I was just wondering if 4MB is normal as I can not find much info on this.
Also if 4MB is normal, why the increase in size?
Thanks,
Sen

Support NTLM authentication against Windows 2012 RD Gateway on iOS/Android

iOS/Android clients use only Basic authentication against Windows 2012 RD Gateway (HTTP transport), while it provides more secure options like NTLM. Both Windows and Mac clients use NTLM in that case.

Hi,
For this you can specify the policy setting for “RD Gateway authentication mode” under below path.
User Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\RD Gateway
In addition you can refer beneath article if find helpful in your case.
Remote Desktop Gateway client fails authentication with “Your user account is not authorized to access the RD Gateway”
http://blogs.technet.com/b/networking/archive/2010/01/14/remote-desktop-gateway-client-fails-authentication-with-your-user-account-is-not-authorized-to-access-the-rd-gateway.aspx
Hope it helps!
Thanks.
Dharmesh Solanki
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

Just got iPhone 5, get home and find iCloud Outlook Add-in does not install under Windows XP. I am loathe to upgrade to Windows Vista/7/8 just yet. Can I obtain and use an earlier version of iCloud Outlook Add-in? My iPad II synchronizes!

Just got iPhone 5, get home and find iCloud Outlook Add-in does not install under Windows XP. I am loathe to upgrade to Windows Vista/7/8 just yet. Can I obtain and use an earlier version of iCloud Outlook Add-in? My iPad II synchronizes!

There is no 'earlier' version that supports XP. iCloud launched with Vista/7 support only.

Windows domain authentication on Oracle Secure Global Desktop

Hello,
I made an upgrade of my oracle secure global desktop 4.62 version to 5.1 version.
The problem is, I was using Windows Domain Authentication in 4.62 and this kind of authentication is not available in the 5.1 version.
So now, my users cannot log in the application.
Do you have a solution ?
Thanks

What are you authenticating to specifically? An AD server? Are you using any of the supported authentication mechanisms now supported?
http://docs.oracle.com/cd/E41492_01/E41495/html/sgd-authentication.html#system-authentication-mechanisms-table

ISE and authenticating against Windows AD with RADIUS realm that is different from the Windows domain

Hello
We are in the process of evaluating the Cisco ISE VMWare appliance with a view to replace our existing FreeRADIUS installation as authentication provider for our wireless network and VPN service. As a part of this we are hoping to migrate our user authentication to Microsoft Active Directory - we have previously authenticated against a different identity store (not MS AD). Because of this legacy our Windows domain is not the same as our RADIUS realm name - the Windows domain is "win.mydomain" whereas we wish to allow users to authenticate using "username@mydomain" or even "[email protected]" as they are doing today. We are experiencing an issue where authentication requests with the format "[email protected]" will be forwarded to the Windows AD whereas authentication requests with the format "username@mydomain" will fail with the log message "User not found in Active Directory". We do not know if the ISE itself is validating the username and triggering this error, or if the error originates from AD. We suspect the that the ISE is not even asking AD because "win.mydomain" is the domain configured in "Active Directory" in "External Identity Sources".
Authentication requests against the AD without a realm are successful (that is, using only "username"). With this in mind we located a post on the Cisco support forums that described a process of proxying the request back to the ISE and strip the realm information, but this was specific for the ACS platform. We have attempted to implement this solution but it is still not working as we would have hoped, and we are not entirely certain where the fault might lie. We are currently using PEAP with MSCHAPv2 for authentication in our WLAN where the main problem is. We suspect that the "proxy-to-self" with realm stripping is an issue with PEAP.
Is there a supported method of achieving our goal, or should we abandon the ISE platform as our scenario is simply not supported?

Seems like your issue maybe related to DNS, when ISE receives the format [email protected], the dns request is failing. However, there is a setting for alternate UPN Suffixes that can be configured to include domain.com and student.domain.com.
Here is a windows article that should fix this for you. Once you get this updated please reboot ISE so it rejoins AD. Try your tests again.
http://technet.microsoft.com/en-us/library/cc772007.aspx
Thanks,
Tarik Admani
*Please rate helpful posts*

Machine authentication by certificate and windows domain checking

Hi,
We intend to deploy machine?s certificate authentication for wifi users.
We want to check certificate validity of the machine, and also that the machine is included on the windows domain.
We intend to use EAP-TLS :
- One CA server.
- each machine (laptop) retrieves its own certificate from GPO or SMS
- the public certificate of the CA is pushed on the ACS as well as on each of the machine (laptop)
- ACS version is the appliance one
- one ACS remote agent installed on the A.D.
- when a user intends to log on the wifi network :
- the server (ACS appliance) sends its certificate to the client. This client checks the certificate thanks to the CA server certificate he already trusts, results : the client also trusts the ACS?s certificate signed by the CA server .
- the client sends its certificate to the server (ACS appliance). This ACS checks the certificate thanks to the CA server certificate he already trusts, results : the ACS also trusts the client?s certificate signed by the CA server but the ACS also checks that this certificate isn?t revocated (the ACS checks this thanks to the CA server CRL ? certificate revocation list).
Am I right about these previous points ?
And then my question is : is it possible to check that the machine is also included in the windows domain ?
That is, is it possible for the ACS to retrieve the needed field (perhaps CN ?? certificate type "host/....") and then perform an authentication request to the A.D. (active directory) thanks to the ACS remote agent ? We want to perform only machine authentication, not user authentication.
Thanks in advance for your attention.
Best Regards,
Arnaud

Hi Prem,
Thanks for these inputs.
I've passed the logs details to full, performed other tests and retrieved the package.cab.
I've started investigating the 2 log files you pointed.
First, we can see that the requests reach the ACS, so that's a good point.
Then, I'm not sure how to understand the messages.
In the auth.log, we can see the message "no profile match". I guess it is about network access profile. For my purpose (machine authentication by certificate), I don't think Network Access Profiles to be mandatory to be configured.
But I'm not sure this NAP problem to be the root cause of my problem.
And when no NAP is matched, then the default action should accept.
We can see the correct name of the machine (host/...). We can see that he's trying to authenticate this machine "against CSDB". Then we have several lines with "status -2046" but I can't understand what the problem is.
I don't know what CSDB is.
I've configured external user database: for this, I've configured windows database with Remote Agent. The domain is retrieved and added in the domain list. And EAP-TLS machine authentication is enabled.
I copy below an extract of the auth.log.
I also attach parts of auth.log and RDS.log.
If you have any ideas or advices ?
Thanks in advance for your attention.
Best Regards,
Arnaud
AUTH 04/07/2007 12:25:41 S 5100 16860 Listening for new TCP connection ------------
AUTH 04/07/2007 12:25:41 I 0143 16704 [PDE]: PolicyMgr::CreateContext: new context id=1
AUTH 04/07/2007 12:25:41 I 0143 16704 [PDE]: PdeAttributeSet::addAttribute: User-Name=host/nomadev2001.lab.fr
AUTH 04/07/2007 12:25:41 I 0143 16704 [PDE]: PolicyMgr::SelectService: context id=1; no profile was matched - using default (0)
AUTH 04/07/2007 12:25:41 I 0143 1880 [PDE]: PolicyMgr::Process: request type=5; context id=1; applied default profiles (0) - do nothing
AUTH 04/07/2007 12:25:41 I 5388 1880 Attempting authentication for Unknown User 'host/nomadev2001.lab.fr'
AUTH 04/07/2007 12:25:41 I 1645 1880 pvAuthenticateUser: authenticate 'host/nomadev2001.lab.fr' against CSDB
AUTH 04/07/2007 12:25:41 I 5081 1880 Done RQ1026, client 50, status -2046

Install Oracle8 client in silent mode under windows environment

I would like to know how can i install Oracle8 client in silent mode under windows
environment.
I would appreciate a prompt reply on this

I would like to know how can i install Oracle8 client in silent mode under windows
environment.
I would appreciate a prompt reply on this

Activating Windows 7 by using KMS Without the Active Directory Domain environment

Dear,
Can we able to activate the Windows 7 O/S Machines by using KMS without the Active Directory Domain environment,As our some of the Computers will not connect with AD domain, we need to setup the speprate KMS
server for this.
Thanks
Balaji K

You can point the KMS clients to the KMS host machine by opening an Elevated CMD prompt:
and running slmgr /skms to point directly to the KMS host.
You do not need a Domain controller.
Volume Licensing: Key Management Service (KMS) Client Options:
/skms <Name[:Port] | : port> [Activation ID] [Activation ID]
Set the name and/or the port for the KMS computer this machine will use. IPv6 address must be specified in
the format [hostname]:port /ckms [Activation ID]
Arnav Sharma | http://arnavsharma.net/ Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading
the thread.

Java webservice client with windows domain authentication

I'm writing (well attempting to) a Java web service client using netbeans that consumes a web service written in C#, that uses NTLM authentication.
If I consume the webservice from a .NET client, authentication isn't a problem; I can just pass the crediantails in on an engine object.
eg engine.Credentials = System.Net.CredentialCache.DefaultCredentials.
Upon consuming this webservice in java the Credentials method doesn't appear on the engine object like it doesn't with it's C# counterpart.
I assume that Java goes about a different way of doing windows domain authentication?
Cheers

for what ever reason it just seemed to start working.

Authentication using multiple domains

We've got a rather complicated configuration scenario here and I need to understand what would need to happen to put this in place, or if it can even be accomplished at all.
We are on Business Objects XIR2 SP3 in a Windows 2003 environment. We are currently using Trusted Authentication with a 3rd party web security component (ISAPI filter) running on our IIS box, however our Web Intelligence implementation is actually done in Tomcat, which is connected to the IIS box simply using the IIS to Tomcat connector (also an ISAPI filter). We currently have the LDAP plugin configured to hit an ADAM directory server, however we are rewriting our web security solution with an AD back end. The AD back end may possibly have two different domains involved, one for internal users and one for external users. I would need to be able to authenticate users from both domains, and have all the other pieces and parts continue to work as far as authentication goes (ADAM via LDAP, trusted authentication for the thin client interface using the WEB_SESSION approach, and both AD directories with usres in each all able to authenticate to the tool set).
First, can you tell me if it's even possible to accomplish this? And second, if it is, what kind of trust relationship does there need to be, if any, between the internal and external users AD domains? I ask because I see only one place to set up an SPN, and there are specific application server services that have to be configured to run as that given service account, so I'm assuming there has to be some sort of trust relationship there since our application servers are all installed in one of those domains.
Thanks,
V

These questions keep getting more complicated
Your domain situation depends on 2 things. If internal and external are 2 domains in the same AD forest(trust is automatic this way) then it should work fine (provided you aren't firewalling off the users as internal/external could imply).
If they are not in the same forest then you would need a 2-way transitive trust, no firewalling, and XI 3.1 in order to map groups/users from both domains into 1 plugin (this would require the AD plugin).
Another option might be to use the LDAP plugin for 1 forest and AD plugin for the other but that would kill your existing users. This is your only option in XIR2 if you have 2 forests.
Regards,
Tim

Sync difference (bug?) in the case of admin and user under Windows XP x64. Sudden loss of bookmarks.

I have just found a problem (a bug?) when syncing my Firefox 11.0 on home desktop under Windows XPx64. Under administrator profile everything is OK. But under the user profile a HUGE amount of bookmarks is lost somewhat suddenly. Just a month ago everything was in the perfect state under the user profile as well.
No problems for portable devices (Android and iPad) and office notebook (WinXP, admin profile) detected.
I would appreciate any hints or help on this since I don't do routine work under admin rights on my home desktop.

Well, resetting sync can solve this problem. Though certain parts of local history on this computer may be lost.

Machine authentication with Windows 7

Version: ISE 1.2p12
Hello,
I'm doing user and machine authentication with ISE.
I use a first authorization rule to authenticate the machine against the AD. If it's part computers of the domain.
Then I use an authorization rule to check if the user's group in AD with the credential he used to open the session + "Network Access:WasMachineAuthenticated = True"
Things seems to be working and I see my switch port is "Authz Success" but shortly after the Windows 7 machine is behaving like 802.1X authentication fails. The little computer on the bottom right has a cross on it.
If I disable and enable again the network card of that windows machine it works.
Does any one of you have an idea about this problem ? something to tweak on Windows 7 like timers...
Thank you

Hi Mika. My comments below:
a) You told me that MAR ("Network Access:WasMachineAuthenticated = True") has some drawbacks. When hibernation is used it can cause problems since the MAC address could have been removed from the cache when the user un-hibernate its computer. Then why not increasing the MAR cache to a value of 7 days then ? Regarding the roaming between wire and wireless it's a problem indeed.
NS: I don't believe that the MAR cache would be affected by a machine hibernating or going to sleep. There are some dot1x related bug fixes that Massimo outlined in his first pos that you should look into. But yes, you can increase the MAR timer to a value that fits your environent
b) You suggest to use one authorization rule for the device which should be part of the AD and one authorization rule for the user with the extra result "IdentityAccessRestricted = False". By the was, are we really talking about authorization rules here ? I will try this but it's difficult for me to imagine how it would really work.
NS: Perhaps there is some confusion here but let me try to explain this again. The "IdentityAccessRestricted" is a check that can be done against a machine or a user account in AD. It is an optional attribute and you don't have to have it. I use it so I can prevent terminated users from gaining access to the network by simply disabling their AD account. Again, that account can be either for a "user" or for a "machine"
z) One question I was asking myself for a long time. All of us want to do machine+user authentication but Windows write Machine OR User Authentication. This "OR" is very confusing.
NS: At the moment, the only way you can accomplish a true machine+user authentication is to use the Cisco AnyConnect supplicant. The process is also known as "EAP-Chaining" and/or "EAP-TEAP." In fact there is an official RFC (RFC 7170 - See link below). Now the question is when and if Microsoft, Apple, Linux, etc will start supporting it:
https://tools.ietf.org/html/rfc7170
Thank you for rating helpful posts!

Android, Ipad authentication under windows domain environment

Similar Messages

Maybe you are looking for