EAP Chaining with Machine TLS and User PEAP

We are deploying an ISE based .1x. The design is to use eap-tls for machine and eap-peap for user. Apparently EAP-Chaining is recommended, but can anyone confirm if we can do chaining based on machine TLS and user PEAP. I have done some investigation and could not find any supporting document, but not any document saying not supporting either. Looking at Anyconnect profile editor, it does not look like this configuration is supported. Has anyone done this before?
Thanks a lot.

http://www.cisco.com/c/dam/en/us/solutions/collateral/enterprise/design-zone-security/howto_80_eapchaining_deployment.pdf
Just change the authentication policy to allow the methods you want to use under eap-fast (eap-chaining) and use the same ones in your nam client configuration settings.

Similar Messages

ISE EAP-Chaining with machine, certificate and domain credentials

Good morning,
A customer wants to do the following for their corporate wireless users (all clients will be customer assets):
Corp. wireless to authenticate with 2-factor authentication:
•1. Certificate
•2. Machine auth thru AD
•3. Domain creds
When client authenticates, they want to match on 2 out of the 3 conditions before allowing access.
Clients are Windows laptops and corporate iPhones.
Certs can be issued thru GPO and MDM for iPhones
Client supplicant on laptops is native Windows - which I understand is a compatibility issue from this thread: https://supportforums.cisco.com/thread/2185627
My first question is: can this be done?
Second question: how would i implement this from an AuthC/AuthZ perspective?
Thanks in advance,
Andrew

You can do this configuring anyconnect with NAM modules on endpoints! But I don't make sense configure some clients with certificate and others with domains credentials...
For your information, I'm actually configuring EAP-Chaining on ISE 1.2 and i'm gotting some problems. The first one I got with windows 8, for some reason windows was sending wrong information about the machine password but I solved the problem installing a KB on windows 8 machines (http://support.microsoft.com/kb/2743127/en-us). The second one I got with windows 7 that are sending information correctly about domain but wrong information about user credentials, on ISE logs I can see that windows 7 are sending user "anonymous" + machine name on the first longin... after windows 7 start if I remove the cable and connect again the authentication and authorization happen correctly. I still invastigate the root cause and if there is a KB to solve the problem as I did with windows 8.
Good luck and keep in touch.
http://support.microsoft.com/kb/2743127/en-us

Machine Authentication and User Authentication with ACS v5.1... how?

Hi!
I'm having trouble setting up Machine Authentication and User Authentication on ACS v5.1 using WinXP SP3 (or SP2) as supplicant.
This is the goal:
On wireless (preferably on wired too) networks, get the WinXP to machine authenticate against AD using certificates so the machine is possible to reach via for example ping, and it can also get GPO Updates.
Then, when the user actually logs in, I need User Authentication, so we can run startup scripts, map the Home Directory and so on.
I have set up a Windows Sertificate server, and the client (WinXP) are recieving both machine and user certificates just fine.
I have also managed to set up so Machine Authenticaton works, by setting up a policy rule that checks on certificate only:
"Certificate Dictionary:Common Name contains .admin.testdomain.lan"
But to achieve that, I had to set EAP Type in WinXP to Smart Card or other Certificate, and then no PEAP authentication occurs, which I assume I need for User Authentication? Or is that possible by using Certificates too?
I just don't know how to do this, so is there a detailed guide out there for this? I would assume that this is something that all administrators using wireless and WinXP would like to achieve.
Thank you.

Hello again.
I found out how to do this now..
What I needed to do was to add a new Certificate Authentication Profile that checks against Subject Alternative Name, because that was the only thing I could find that was the same in both user certificate and machine certificate.
After adding that profile to the Identity Store Sequences, and making tthe appropriate rule in the policy, it works.
You must also remember to change the AuthMode option in Windows XP Registry to "1".
What I really wanted to do was to use the "Was Machine Authenticated" condition in the policies, but I have never gotten that conditon to work, unfortunately.
That would have plugged a few security holes for me.

Database auto start with machine on and shutdown with machine shutdown

i have installed oracle 10g release 2 on linux 5.1. now i want to start my database with machine on and shut down when the machine is shutdown.
for this i have do the following steps but i does not works.
Log in as the root user
vi /etc/oratab
$ORACLE_SID are not allowed.
orcl:/u01/app/oracle/product/10.2.0/db_1:Y
change the directory to /etc/init.d
Create a file called dbora, and copy the following lines into this file:
vi dbora
#! /bin/sh -x
# Change the value of ORACLE_HOME to specify the correct Oracle home
# directory for your installation.
ORACLE_HOME=/u01/app/oracle/product/10.2.0/db_1
# Change the value of ORACLE to the login name of the
# oracle owner at your site.
ORACLE=oracle
PATH=${PATH}:$ORACLE_HOME/bin
HOST=`hostname`
PLATFORM=`uname`
export ORACLE_HOME PATH
if [ ! "$2" = "ORA_DB" ] ; then
if [ "$PLATFORM" = "HP-UX" ] ; then
remsh $HOST -l $ORACLE -n "$0 $1 ORA_DB"
exit
else
rsh $HOST -l $ORACLE $0 $1 ORA_DB
exit
fi
fi
case $1 in
'start')
if [ "$PLATFORM" = "Linux" ] ; then
touch /var/lock/subsys/dbora
fi
$ORACLE_HOME/bin/dbstart $ORACLE_HOME &
'stop')
$ORACLE_HOME/bin/dbshut $ORACLE_HOME &
echo "usage: $0 {start|stop}"
exit
esac
Change the group of the dbora file to the OSDBA group (typically dba), and set the permissions to 750:
# chgrp dba dbora
# chmod 750 dbora
Create symbolic links to the dbora script in the appropriate run-level script directories as follows.
# ln -s /etc/init.d/dbora /etc/rc.d/rc0.d/K01dbora
# ln -s /etc/init.d/dbora /etc/rc.d/rc3.d/S99dbora
# ln -s /etc/init.d/dbora /etc/rc.d/rc5.d/S99dbora
after done these changes i restarted my system but the database is not started automatically.....
please help where i am doing wrong...and correct me..

Re: Oracle 10g on linux 5.1 issue
DUPLICATE!

EAP Chaining with Cisco ACS 5.x and the Cisco Anyconnect NAM Client

Hi Guys,
Whilst I’m well aware of the limitations of the built in the windows Wireless 802.1x supplicant. Is there a way, using the NAM client to authenticate both a computer and a user simultaneously, when used for authentication to wireless networks?
As has been posted many times before on this forum, this isn’t possible due to windows not authenticating with the 'computer account' whilst the user is logged in, but with the NAM client it seems possible to do both user and computer authentication based on the options it gives you with EAP-Fast and 'EAP Chaining'.
Can anyone validate this is possible? I have the design guide for exactly this for Cisco ISE but i need it to work on ACS (5.x).
Thanks in advance.
SteveH

Bobby, I ran into the same issue with the "15015 Could not find ID Store" issue. It turned out to be an issue with communication between the ACS and AD. It looked like AD was connected successfully, but until I rebooted ACS, I kept getting the same error. It was like it couldn't see the AD security groups even though it could scan the AD tree successfully.
So, try rebooting ACS if you haven't already and see if that resolves the error.

Will Mountain Lion back up to Time Machine with Filevault on and user logged in? Or do I have to log out like in previous versions of OSX?

I want to encrypt my boot drive with filevault but hate having to log out for time machine backup to work. Does Mountain Lion fix this or is this just how it's gonna be?

I want to encrypt my boot drive with filevault but hate having to log out for time machine backup to work. Does Mountain Lion fix this or is this just how it's gonna be?

Share a Hard Drive with Multiple Drives and Users

Background: I have an Airport Extreme (4th Generation) with two external hard drives connected via USB 2.0 and USB hub. I have Airport Utility setup to allow access to both drives via user accounts and passwords. From what I have gathered the way in which the user accounts and passwords work is the Airport Extreme makes two directories at to root level of the hard drive, 'Users' and 'Shared'. All files located in the 'Shared' directory are available to all user accounts setup in Airport Utility. Within the 'Users' directory are sub-directories named for each user account that is setup. All files located within the user directories are available to each respective user.
My trouble is the ability to see both the 'Shared' folders and the respective user folder when I authenticate with a user account. I am able to see the files in the 'Shared' directory on each of the two disks but it seems I am only able to see one of the user account directories and files.
Questions: My two questions are:
1) Is my understanding outlined above correct?
2) How might I be able to see the user directory on both disks as well as the 'Shared' directory on both disks.
I am hoping to still be able to use user accounts to access the disks as I have multiple people who store their files.

It didn't. After a night of testing, I found that I could get the router to at least let me create shares if I partitioned it as an MBR drive (GPT would not work at all), but it would not even rcognize a partition sized to 2TiB (tebibytes, 2048 GiB) or even one sized to 2TB (terabytes). The most it would recognize through my trial and error was about 1.5TiB, which I found odd.
This setup would have been too onerous, as it would have made about 746GiB completely unusable on the drive (outside the largest area referenced by an MBR partition table), and I would have had a main partition for files and one that would be invisible to the router (it only read the first partition, obviously).
So luckily, Best Buy took the external hard drive back with no restocking fee (the WD My Book Essentials 3TB is on sale at $150 there if anyone is interested). I ended up just getting a Synology NAS enclosure and 2 2TB hard drives. I'll get those on Thursday (hopefully).

Problems with remote control and user accounts - error 1759?

We're running:
-XP Pro SP2 clients with Zen SP1 IR3a agent, 4.91 SP2 Netware client.
-We are NOT running Middle Tier.
-Novell servers are running Netware 6.5 SP7, E-directory 8.7.3.10b or 8.8.
-Zen server is also SP1 IR3a.
We have no problem using remote control on workstation objects. We are having intermittent issues with remote controlling user objects. When the issue occurs, we receive the following error, "Error 1759: The selected user is not logged in on any workstations" even though the user is in fact logged in. After some more research, it appears that the "networkAddress" attribute of the user object is blank so we feel that this is the root cause. My question is what would cause the networkAddress attribute to randomly not update? For instance we had a user (verified his login) who we could not remote via the user object (workstation object worked). We checked his networkAddress attribute and found that it was empty. User rebooted and logged in again and his networkAddress attribute populated, and then we could remote control him via the user object. Now this isn't always the case after a reboot. There doesn't appear to be any pattern to when the networkAddress attribute does or does not update. In fact, this particular user has a laptop so he boots it up fresh every morning yet he was not showing a network address when he logged in initially today.
We've followed the troubleshooting steps in Novell Documentation without any success. Is there anything else that we might be missing, especially with respect to getting the networkAddress attribute to update? We ran a DSreport on that attribute and found about 500 out of a total of 1500 users had no networkAddress. Some of those are sure to be legitimate but that number is much too high for the number of people that should be in the office.
I've read some older threads on the subject but none of them really provide a firm solution. Also most of the older threads reference Middle Tier which we are not using.
Thanks in advance.

> 4.91 SP2 Netware client.
You could try this TID:
"A user will no longer have an entry in their "Network Address" attribute
even though they are logged into the eDirectory Tree."
http://www.novell.com/support/viewCo...1262&sliceId=1
"Resolution"
"This was fixed in the 4.91 SP3 client. NWFS.SYS was modified so that it
will check the monitor connection on a reconnect and if it is not connected
close the connection and try and get a new monitor connection to the tree.
Prior to the 4.91 SP3 client, the solution is to have the user login again
so that it issues the NDS Finish Login request again that will populate
Network Address again."
Regards
Rolf Lidvall
Swedish Radio (Ltd)

Problems with Snow Leopard and users

I have upgraded 3 x 10.5 iMacs to 10.6. They have been working fine for the last 2 months, but now have some strange problems on the units.
1. On the one, it cannot save documents on the iMac under that user. If I create another user, then that new user can save documents. Is there anyway to correct this. It seems like a permissions issue.
2. On the second unit it won't allow the user to convert documents with the MS OpenXML converter from 2008 to 2004 files. But if I create a new user, then that new user can convert the files.
3. And on the third unit, the user can't print certain documents, but guess what when you create a new user, that user can print the certain documents.
It seems like a corrupt user file somewhere that is specific to 10.6. Has anyone else had these issues?
I wanna check if there are any fixes before I start moving user data from corrupt accounts to new accounts. Maybe there is an easier solution.

Thanks for the feedback. Here's the second way.
While logged into the newly created admin account, backup the bad account's folder, delete the bad account, selecting the save data option (which is stored in /Users/Deleted Users/ as a disk image), recreate the bad account using the same username/password combo, log out and back into the recreated original account. If the problem's solved, open the saved data dmg file in /Users/Deleted Users/, open the /Library/Preferences/ folder from the saved data, open the current /Users/restored account/Library/Preferences/ folder, and slowly copy plist files from the saved data folder to the current one that don't exist in it. Log out and back in to ensure there's no conflict and things still work correctly. Resolving conflicts or identifying corrupt plist files is a laborious process.

Trouble with Component Wizard and User Database

Hello,
I am a user of Circuit Design v.13.0 Power Pro Edition (Windows 8 Pro x64, intel Core i7 3GHz, 4GB memory, 500GB HDD).
On MultiSim, I tried to create a 324-pin component via the Component WIzard, and had this component listed in the User Database.
I failed, however, to register the symbol (ANSI Y32.2) created on the Symbol Editor, receiving an error saying something like:
"The ANSI symbol for component ......... cannot be found or is invalid. The symbol is saved in the database. Check if the symbol is correct."
(This is an English intepretation of the original Japanese, so may not be the exact English error message.)
Actually, no symbol appears on the Database Manager.
I have found that this error does not occur for pin counts equal to or fewer than 144.
Furthermore, other 324-pin and 256-pin components created on MultiSim v.12.0 caused an error when I tried to edit these components in the User Database, with a message like:
"A trouble occurred in reading the symbol data of component ..."
Could anyone tell me how I can resolve these problems?
I will greatly appreciate your help.
Regards,
Akira

I have the same problem. I am using Multisim 13.0.1 (13.0.1059) with database version 13.0.c, Win7 x64
I found that when you have a component symbol with 146 pins, it works, but when you add one more pin, you get an error saying, "The ANSI symbol for component [my component name] in family [component family name] is missing or invalid. The symbol will still be saved to the database. Check to ensure the symbol is correct.
Multisim will not allow opening the component in the database for editing. If you try to place the component on a schematic, you get the error "There was a problem reading symbol data for component [component family name]/[my component name]

Problem with Archive Link and User ID

Dear Experts,
Currently we are attaching documents to business object using archive link feature through T code OAWD.
when user uploaded documents & when we try to search documents with Tr. code OAAD, we are not able to find from whcih User id documents got uploaded.
As per client requirement, we had to find from which user id documents got uploaded as around 10 user id's got authorization of uploading documents against same business object.
Even in individual Tcodes other than tr. code OAAD of business objects where documents are seen, we don't find User Id/Creator name.
any suggestions will be much useful...
Thanks in advance...

The standard archivelink tables (TOA*) do not gather this data. If this is a must have requirement then using single step workflow may give you the ability to capture this data within the workflow logs.
To create this scenario you would enable only the storage scenario "storing for subsequent entry" within the document presettings via OAWS. Then when a document was uploaded it would create a "workitem" that is sent to the agent id. Default will be user if no setting was created in OAWS.
The user would then have to go to their SAP workplace inbox to execute the work item and "link" the document to the transaction.
This scenario is sometimes referred to as "early archiving" by old timers like myself.
It is most often used in Accounts Payable scenarios where a central shared scanner is passing out many work items to a larger group.
From TAO* Tables we can use SAP_OBJECT to Identify Invoices with PO by object BUS2081 or invoices without PO by object FIPP. From the field OBJECT_ID we can match a specific invoice number. BUS2081 shows invoice number + fiscal year as the Object id. FIPP shows Company code + invoice number + fiscal year. The ARC_DOC_ID field gives us the unique document identification string for the scanned image. AR_DATE = the date the work item is completed. This is when the invoice document is “parked”.
A selection from table SWWLOGHIST searching for METHOD SWW_WI_STATUS_TO_COMPLETED and METH_EDATE = to AR_DATE from TOA* Table (26.06.2012) and PARA_VAL_1 = *ARC_DOC_ID* (*aaaakkjdx1ce6yn3e3aacaerb12zi*) will provide output from which you can gather the work item ID.
Select WI_ID then query table SWWWIHEAD for overview status of item.
From table SWWWIHEAD you can gather such information on the work item as the work item creator WI_CREATOR, the work item status WI_STAT, creation date WI_CD, completion date WI_AED, and work item agent WI_AAGENT.
The WI_CREATOR will be the user who "created the workflow item" for your report.
This a the "long way around" to overcome this lack of data being gathered by ArchiveLink documents.
I hope this late answer is helpful for someone.

FlexibleUI - UICommands with Path KM and User KM from the context.

I need to write one new Java Portal Class, for new KM Command. This command should do the following action:
- get context information of KMC (specifically portal user and KM path)
- call URL with this data. (Example: http://domain:port/service?userkm=valueuserkm&pathkm=valuepathkm )
I have modify example of FlexibleUI - UICommands, and create a new class that call a URL, but can't find the class and method for get context and catch the user and path of KM user.
this is the code for the class of UICommands:
package com.sap.example.flexible.ui.command;
import java.util.List;
import com.sapportals.wcm.WcmException;
import com.sapportals.wcm.rendering.base.IRenderingEvent;
import com.sapportals.wcm.rendering.base.IScreenflowData;
import com.sapportals.wcm.rendering.uicommand.AbstractCommand;
import com.sapportals.wcm.rendering.uicommand.ICommand;
import com.sapportals.wcm.rendering.uicommand.LinkAttributes;
import com.sapportals.wcm.repository.IResourceContext;
import com.sapportals.wcm.repository.IResource;
* Copyright (c) 2005 by SAP AG. All Rights Reserved.
* SAP, mySAP, mySAP.com and other SAP products and
* services mentioned herein as well as their respective
* logos are trademarks or registered trademarks of
* SAP AG in Germany and in several other countries all
* over the world. MarketSet and Enterprise Buyer are
* jointly owned trademarks of SAP AG and Commerce One.
* All other product and service names mentioned are
* trademarks of their respective companies.
* This class is a sample implementation for a
* UICommand using external eventing.
* @author Thilo Brandt, SAP AG
* @version 1.0
public class SimpleExternalCommand extends AbstractCommand {
     protected String getLabel() {
        return "myButtonLabelDURO";
            protected String getTooltip() {
                    return " myButtonTooltipDURO";
     public SimpleExternalCommand() {
          //super("SimpleExternalCommand", "SimpleExternalCommand");
          super("myButtonTextKey", "myTooltipTextKey");
     public ICommand getNewInstance() {
          return this.initNewInstance(new SimpleExternalCommand());
     public IRenderingEvent execute(IScreenflowData arg0) throws WcmException {
          return null;
     public String[] getTargetParameters() throws WcmException {
          return new String[0];
     //public void setTargetParameters(List arg0, IResourceContext arg1)
     public void setTargetParameters(List list, IResourceContext context)
          throws WcmException {
     public boolean isExecutable() {
          return true;
     public boolean raisesEvent() {
          return false;
// Inicio de Modificación de Código para uso de Parámetros
        public LinkAttributes getLinkAttributes() {
          String Target = "_blank";
          String lURL1 = "http://www.google.com/search?hl=es&q=";
          String lURL2 = "PARAMETRO";
          String lURL3 = "&lr=";
// Get User KM from context
// lURL2 = UserKM;
// Get path KM from context
        String lURL   = lURL1 + lURL2 + lURL3;
          return new LinkAttributes(lURL, Target);
please helpme to get userKM and pathKM.
thank in advance.
Junior.

Hi,
To get the KM Path:
String path = getResource().getRID().getPath();
To get the present User:
IPortalComponentRequest pcr =
                (IPortalComponentRequest) getProxy().getDynamicPage().getPageContext().getRequest();
pcr.getUser();
To create URL call with datas when UICommand is clicked. You should modify your getLinkAttributes method.
Check this for an example:
https://forums.sdn.sap.com/thread.jspa?threadID=334529
Greetings,
Praveen Gudapati
[Points are always welcome for helpful answers]

How do I add an ipad to my itunes account which was previously associated with another account and user?

how do I add an ipad to devices in my itunes account which was previously associated with another account?

Just sign into your own ID in Settings>iTunes & App Store. Sign out of the old ID and sign into your ID. I get the feeling though, that there is more to what you are trying to do or want to do and I'm not understanding or you are not explaining completely.
If this is a previously owned iPad, it should have been erased before you got possession of it.

I'm trying to buy a gift card on itunes and it says i have to contact apple support to complete my transaction, but it doesn't say what the problem is. the computer is authorized, the credit card is authorized. i can log in with my password and user ID.

I'm trying to email my goddaughter a gift certificate for itunes, but i keep getting a message that says, you have to contact support to complete the transaction. the computer is authorized, the credit card is authorized, and i have a userid and password with which i can log on to my account, so i don't know what i'm doing wrong. any ideas?

Hi...
My credit card is from El Salvador And I can't buy english movies?
Your credit or debit card credentials must be associated with the same country where you reside.
"Although you can browse the iTunes Store in any country without being signed in, you can only purchase content from the iTunes Store for your own country. This is enforced via the billing address associated with your credit card or other payment method that you use with the iTunes Store, rather than your actual geographic location."
From here > The Complete Guide to Using the iTunes Store | iLounge Article

Query SQL with variables Parameters and user defined tables

Hi everyone
I got a problem about Query SQL
[dbo].[@CSOURCE] is a user defined table
select * from [dbo].[@CSOURCE]
you can get the result in following
code    name
T01      newspaper
T02      TV
T03      radio
T04      friends
when I execute the following SQL   Statements ，I get an error
SELECT T0.CardCode , 0.CardName ,T1.Name ,T2.SONumber
FROM OCRD T0    LEFT JOIN [dbo].[@CSOURCE] T1 ON T0.U_CSOURCE = T1.Code
                             LEFT JOIN (SELECT T0.CardCode ,COUNT(T0.DocNum)SONumber
                             FROM ODLN T0 INNER JOIN OCRD T1 ON T0.CardCode = T1.CardCode
                            WHERE T1.GroupCode =111
                            AND   (T0.DocDate >=[%0] or [%0]='')
                            AND   (T0.DocDate <=[%1] or [%1]='')
                            GROUP BY T0.CardCode) T2 ON T0.CardCode=T2.CardCode
WHERE T0.GroupCode =111
and T0.CardType ='C
Is there anyone can correct it for me
thank you very much
Edited by: Li Mishan on Jul 17, 2008 9:36 AM
Edited by: Li Mishan on Jul 17, 2008 9:40 AM

I am sorry .It is just a mistake of my typewriting.
The following is the whole SQL
dbo.@CSOURCE is a user table.It's content is
code name
T01    newspaper
T02    TV
T03    radio
T04    friends
declare @m int
declare @FromDate DateTime
declare @ToDate DateTime
set @m=(SELECT count(*) FROM ORDR T0 WHERE T0.DocDate >=[%0] and T0.DocDate <=[%1])
set @FromDate=[%0]
set @ToDate=[%1]
/*****************If I do not connect user tavble dbo.@CSOURCE ，I will succed *****************************************************/
SELECT T0.CardCode ,T0.CardName ,T2.SONumber,T1.Name
FROM OCRD T0 LEFT JOIN [dbo].[@CSOURCE] T1 ON T0.U_CSOURCE = T1.Code
                           LEFT JOIN (
                                            SELECT T0.CardCode ,COUNT(T0.DocNum)SONumber                                            FROM ODLN T0 INNER JOIN OCRD T1 ON T0.CardCode = T1.CardCode
                                            WHERE T1.GroupCode =111
                                            AND (T0.DocDate >=@FromDate or @FromDate='')
                                            AND (T0.DocDate <=@ToDate or @ToDate ='')
GROUP BY T0.CardCode
                                        ) T2 ON T0.CardCode=T2.CardCode
WHERE T0.GroupCode =111
and T0.CardType ='C'
when I excute the SQL, It return a error , whith says the column name '%0' is invalid.
If I delete "set @m=(SELECT count(*) FROM ORDR T0 WHERE T0.DocDate >=[%0] and T0.DocDate <=[%1])"
and rewrite "set @FromDate='2008.05.01' set @ToDate='2008.07.01' "
It Shows the following results
   CardCode     CardName     SONumber     name
1      000070        Deng. Jiahua   1                newspaper
2      000293        LU .Weijuan    1                radio
3      000313         Xie .Jifang       3               TV
Edited by: Li Mishan on Jul 18, 2008 4:42 AM
Edited by: Li Mishan on Jul 18, 2008 4:43 AM
Edited by: Li Mishan on Jul 18, 2008 5:43 AM

EAP Chaining with Machine TLS and User PEAP

Similar Messages

Maybe you are looking for