ISE and 802.1x - Retrieve User Cert from AD for Auth without it being in the Personal Store?

Hello,
We are implementing 802.1x EAP-TLS wired at the moment with Cisco ISE, and wireless is to come after that, along with our internal PKI. I set up the PKI, and our network engineer is setting up the ISE. We currently have it set to first authenticate the computers with a computer certificate (allowing access to AD, among some other things), and then further authenticate the users with user certificates.
I don't have much knowledge of Cisco ISE, and plan to learn as we go, but I'm wondering:
Is it possible to authenticate the computer via the computer certificate, getting access to AD, and then have the ISE check AD for the User certificate INSTEAD of the User certificate being in the local Personal store of the client computer? We have autoenrollment going for user certificates, but it seems to be cumbersome (in thought) that once 802.1x is enabled, a new computer/employee coming on the network has to first go to an unauthenticated port to be able to download the User certificate in the Personal store, before then being able to use an 802.1x port?
I guess that makes two questions:
1) Can ISE pull the user cert from AD, without needing it in the local Personal store?
2) What's the easiest way to handle new computers/users that don't already have the User cert in their local Personal store once 802.1x is enabled?

1)No
2)Use EAP-Chaining with EAP-TLS and PEAP
For this scenario, i would go with Cisco AnyConnect NAM, and then use EAP-Chaining, with EAP-TLS for machine auth, and then PEAP for user authentication. This way you can make sure that both the machine and the user is authenticated, and more importantly, that a user can not get on the network with their user identity only and no machine identity. Using windows own supplicant for this, gives no garantee that the user has logged in from an authenticated machine. The feature that used to be used for this before EAP-Chaining was introduced, is called MAR, and has many problems, making it almost useless in a corporate environment. Security wise, the PEAP-MSCHAPV2 is tunneled in EAP-FAST and does not have the same security issues as regular PEAP.

Similar Messages

I tried buying an album off the iTunes Store but I didn't know the security question answers. It disabled my account from buying for 8 hours but I want the album by tonight! Help please?!?!

I tried buying an album off of the iTunes Store but I didn't know the security question answers. I reached the limit for the amount of answers and now it disabled my account from buying for 8 hours but I want the album by tonight! Can anyone help?!

If you've disabled your account for 8 hours then you will need to wait until the 8 hours have completed.
When the 8 hours are up, then if you have a rescue email address (which is not the same thing as an alternate email address) on your account then you should get a reset link on your account : http://support.apple.com/kb/HT6170
If you don't have a rescue email address (you won't be able to add one until you can answer your questions) then you will have to contact Support in your country to get the questions reset.
Contacting Apple about account security : http://support.apple.com/kb/HT5699
When they've been reset (and if you don't already have a rescue email address) you can then use the steps on this page to add a rescue email address for potential future use : http://support.apple.com/kb/HT5620

How to retrieve user name from a given Subject?

I am in a situation where I need to retrieve user name from the Subject that is populated when user logs in. I have the active Subject and I do following to get the principals in the subject and iterate through them:
Set principals = subject.getPrincipals();
Iterator ite = principals.iterator();
while (ite.hasNext()) {
Principal prin = (Principal)ite.next();
String name = prin.getName();
But this contains all the principals, including user name, roles, password, etc. How do I programmatically determine which one is user name?

Don't you have different principal types? I am making a jaas module and I have different principals for roles, groups etc. I think of principals as attributes, the type in the attribute name and the principal name is the attribute value.
To get all the principals of the type SomePrincipal, you can use:
Set principals = subject.getPrincipals(SomePrincipal.class)
You can also take som principal an test wether it is an instance of som type:
if (Principal p instanceof SomePrincipal){..}
An other solution which might be better if you have many different attributes is to store both attribute name and value in the name of the principal.
If "mark" is a username the principal name will be "username:mark" el.
Then it will be easy to find the username.

If I remove itunes and its drivers from my computer, as recommended by someone at the Apple store for a problem I'm having, I know my music will come back, but will my playlists still be there as they are now?

If I remove itunes and its drivers from my computer, as recommended by someone at the Apple store for a problem I'm having, I know my music will come back, but will my playlists still be there as they are now? I forgot to ask.

For general advice see Troubleshooting issues with iTunes for Windows updates.
The steps in the second box are a guide to removing everything related to iTunes and then rebuilding it which is often a good starting point unless the symptoms indicate a more specific approach. Review the other boxes and the list of support documents further down the page in case one of them applies.
Your library should be unaffected by these steps but there is backup and recovery advice elsewhere in the user tip.
tt2

How do I remove my credit card from my account and still download free apps. Bc that card is no more good anymore the App Store will not let me download any apps . I no longer have a credit or debit card.so PLS help

How do I remove my credit card from my account and still download free apps? because that card is no more good anymore the App Store will not let me download any apps . I no longer have a credit or debit card.so PLS help

On your iPad tap on your id in Settings > iTunes & App Store and tap on 'View Apple ID' on the popup and log into your account - that should give you a payments link on your account's page. Or on your computer's iTunes you should be able to edit your payment info by going into the Store > View Account menu option and logging into your account, and on your account's details page there should also be a payment link.
Changing payment info : Change or remove your payment information from your iTunes Store account (Apple ID)
If you don't get the 'none' option on the payment details screen : Why can’t I select None when I edit my Apple ID payment information?

HT201272 I have deleted a song from my library and want to re-download it. When I access my purchased items in the iTunes store, the song has the 'purchased' button next to it and won't let me re-download. Any suggestions for things to try?

I have deleted a song from my library and want to re-download it. When I access my purchased items in the iTunes store, the song has the 'purchased' button next to it and won't let me re-download. Any suggestions for things to try?

While you can redownload most past purchases without charge, you can't redownload movies without paying again. See Downloading past purchases from the App Store, iBookstore, and iTunes Store: http://support.apple.com/kb/HT2519

I'm running Adobe 9 pro on snow leopard and when I save or print from word for mac 14 the bottom gets cuts off

I'm running Adobe 9 pro on snow leopard and when I save or print from word for mac 14 the bottom gets cuts off. Can someone help?

Ah! You're creating a PDF out of Word through Acrobat. The cutoff is most likely being affected by the printer chosen.
When you call up the print dialogue in Word, check to see what printer is being used. If it's a typical inkjet printer, Acrobat is using the print margins of that printer as the cutoff area. Since most such printers can't print to the last inch and half or so of the paper, that's where it would be cut off.
Near the bottom, under the preview of the document, click on the Page Setup button. It doesn't really matter which printer you select here. Under Paper Size, choose Manage Custom Sizes. Under the Non-Printable Area heading, choose the same printer and set the paper size you're using.
Note that the unprintable margins for that printer will be filled in automatically. That's what's being cut off. Click the + button to create a modified version. The default will be "Untitled". Give it a new name if you want. Then set all of the margins to zero. Click OK. Now you'll have that as a choice under Paper Size. Doesn't matter that the actual printer can't use this setting since you're going to a PDF. Click OK to get back to the main Word print dialogue.
Now choose Save as Adobe PDF. It should give you an exact duplicate of what's on screen in Word since as far as Acrobat is concerned, your "printer" has no unprintable margins.

Why does my iphoto continue to say " photos are being imported to the photo library" every time I try to close? I have not been imported and this has been keeping me from closing for weeks.

Why does my iphoto continue to say " photos are being imported to the photo library" every time I try to close? I have not been imported and this has been keeping me from closing for weeks.

What Operating System are you running?
Mountain Lion there seem to be a glitch that continually ask this on quit.
You have Apple Menu ()>force quit>iPhoto

I live in the UK and want to purchase gift cards from iTunes for people in the US but It won't allow me to use my UK address and credit card. Can I or cant I?

I live in the UK and want to purchase gift cards from iTunes for people in the US but It won't allow me to use my UK address and credit card. Can I or cant I?

You would have to work with a retailer selling iTunes cards who would accept a non-US credit card. Best Buy is a possibility; they carry iTunes prepaid cards and will accept orders from other countries:
http://www.bestbuy.com/site/Help-Topics/International-Orders/pcmcat204400050019. c?id=pcmcat204400050019
You'll have to have the order shipped directly to the person in the US (or at least someone with a US address, who could then repackage and resend the cards for you).
Regards.

Why is my mail saying "cannot get mail - user name or password for Gmail is incorrect" but on the Gmail app there is no problem. I have checked the settings and everything seems to be ok

Why is my mail saying "cannot get mail - user name or password for Gmail is incorrect" but on the Gmail app there is no problem. I have checked the settings and everything seems to be ok

Go here and unlock your account... https://www.google.com/accounts/DisplayUnlockCaptcha

HT201441 I buy may iPhone 5 from the UK store ,, It s A new one and no one has used it before ,, the problem that it asked for an other apple ID !!! ,, my order for my iPhone is here in the UK store .. what should i do now ???? ,,, help me please

I buy may iPhone 5 from the UK store ,, It s A new one and no one has used it before ,, the problem that it asked for an other apple ID !!! ,, my order for my iPhone is here in the UK store .. what should i do now ???? ,,, help me please

Take it back and ask for a refund or a replacement.

When I transfer photos from my camera to my computer, where does the computer store them?

When I transfer photos from my camera to my computer, where does the computer store them?

Assuming you're using iPhoto 09 or later.
By default the photos are stored in the iPhoto Library in your Pictures Folder.
The iPhoto Library is a Package File. This is simply a folder that looks like a file in the Finder. This is a simple protection from users inadvertently corrupting their library by browsing through it with other software or making changes in it themselves.
Want to look inside? Go to your Pictures Folder and find the iPhoto Library there. Right (or Control-) Click on the icon and select 'Show Package Contents'. A finder window will open with the Library exposed.
Standard Warning: Don't change anything in the iPhoto Library Folder via the Finder or any other application. iPhoto depends on the structure as well as the contents of this folder. Moving things, renaming things,, deleting them or otherwise making changes will prevent iPhoto from working and could even cause you to damage or lose your photos.
As an FYI: There are many, many ways to access your files in iPhoto: You can use any Open / Attach / Browse dialogue. On the left there's a Media heading, your pics can be accessed there. Command-Click for selecting multiple pics.
(Note the above illustration is not a Finder Window. It's the dialogue you get when you go File -> Open)
You can access the Library from the New Message Window in Mail:
There's a similar option in Outlook and many, many other apps. If you use Apple's Mail, Entourage, AOL or Eudora you can email from within iPhoto.
If you use a Cocoa-based Browser such as Safari, you can drag the pics from the iPhoto Window to the Attach window in the browser.
If you want to access the files with iPhoto not running:
For users of 10.6 and later: You can download a free Services component from MacOSXAutomation which will give you access to the iPhoto Library from your Services Menu.
Using the Services Preference Pane you can even create a keyboard shortcut for it.
For Users of 10.4 and 10.5 Create a Media Browser using Automator (takes about 10 seconds) or use this free utility Karelia iMedia Browser
Other options include:
Drag and Drop: Drag a photo from the iPhoto Window to the desktop, there iPhoto will make a full-sized copy of the pic.
File -> Export: Select the files in the iPhoto Window and go File -> Export. The dialogue will give you various options, including altering the format, naming the files and changing the size. Again, producing a copy.
Show File: a. On iPhoto 09 and earlier: Right- (or Control-) Click on a pic and in the resulting dialogue choose 'Show File'. A Finder window will pop open with the file already selected. 3.b.
b: On iPhoto 11 and later: Select one of the affected photos in the iPhoto Window and go File -> Reveal in Finder -> Original. A Finder window will pop open with the file already selected.

How can i remove pictures from my droid turbo without having to use the touch screen on the phone at all?

how can i remove pictures from my droid turbo without having to use the touch screen on the phone at all? my screen is cracked and i am waiting on a replacement phone. as far as i can tell in order to access the phone storage through my computer, i have to use the touchscreen to enable it so that the computer will see it as a camera. I can't do that as the top half of the touschscreen is unresponsive. any suggestions? teaches me to use the backup services offered in the future, but i still need a short term solution for this time.

I'm sorry to hear your screen is cracked spence425. I know its difficult to use the phone while its damaged. I'm happy you are receiving a replacement device. Have you saved any of your pictures and other data to the cloud? Here is a link about the cloud http://vz.to/1mF0GIx . Unfortunately, you will be unable to remove any data from the phone if the screen is unresponsive but if you are looking to transfer data to your new phone, it would have needed to be saved via the cloud first. Keep us posted.
Kinquana_VZW
Follow us on Twitter @vzwsupport

An app I purchased and downloaded directly to my Ipad is missing and not in my app files on my PC. When I go to the app store to re-download it I can not the says I have already downloaded it. How do I get my app back?

An app I purchased and downloaded directly to my Ipad is missing and not in my app files on my PC. When I go to the app store to re-download it I can not and the app says I have already downloaded it. How do I get my app back?

You should be able to copy it from your iPad to your computer's iTunes via File > Transfer Purchases, or you should be able to re-download it via the Purchased link under Quick Links on the right-hand side of the iTunes Store home page - if that says that it's already downloaded, then that implies that it's already on your computer

HT1473 How do I play music/playlists from another iTunes account without having to transfer the purchases to my account?

How do I play music/playlists from another iTunes account without having to transfer the purchases to my account?

Get copies of the song files and add them to your iTunes library.

ISE and 802.1x - Retrieve User Cert from AD for Auth without it being in the Personal Store?

Similar Messages

Maybe you are looking for