topic Re: Avoid username password prompt everytime a workstation unplugs/plugs in Network Access Control

Avoid username password prompt everytime a workstation unplugs/plugs

umahar — Mon, 18 Jun 2018 15:20:43 GMT

I have a customer who is using 2FA for wired dot1x.

Their requirement is to not prompt the machine for username/credentials everytime the machine unplugs and plugs for 8 hours.

The user comes int the morning and enters its username and 2FA and then can seamlessly move around for next 8 hours.

Any thoughts on if and how that can be achieved ?

Maybe if we can dump authenticated machines hitting various authorization rules into identity groups the first time they authenticate and then purge them at the end of the day.

Re: Avoid username password prompt everytime a workstation unplugs/plugs

Jason Kunst — Tue, 19 Jun 2018 16:45:48 GMT

What about machine cert plus cached user cert or creds?

Or machine cert plus CWA flow or using CWA with 2FA perhaps? Not sure if possible but endpoint could be registered to a endpoint group for day perhaps.

Re: Avoid username password prompt everytime a workstation unplugs/plugs

thomas — Wed, 20 Jun 2018 21:54:24 GMT

With username/password you can cache credentials in the supplicant so you do not need to re-type them with every new authentication. I'm not aware of how you can cache a token. You have chosen a very secure authentication method - welcome to the side effect! Suggest you consider certificates which can be automatically presented as Jason suggested.

Letting an endpoint on for a set time (8 hours) is usually only done with Guests where the consequences of a MAC spoof would be fairly inconsequential.

Re: Avoid username password prompt everytime a workstation unplugs/plugs

umahar — Thu, 21 Jun 2018 14:26:39 GMT

Thanks Jason and Thomas for your inputs

Jason, I already discussed possibility of using CWA but customer does not want to add another flow. Besides MAC spoofing is a big risk.

Thomas I did discuss the same thing with customer that they will have to make a trade off between security and user experience. They have very strict instructions from their management to only use 2FA for NAC.