topic Re: Machine + User Auth for MAC OSX in Network Access Control

Machine + User Auth for MAC OSX

Ale79 — Mon, 20 Mar 2017 16:01:29 GMT

Just wanted to check if there is a way to authenticate Mac IOS X - machine authentication and User authentication against our ISE? If it is not supported, is there any alternative way?

Re: Machine + User Auth for MAC OSX

Jason Kunst — Mon, 20 Mar 2017 19:17:49 GMT

Although title and abstract do not match, this topic is covered in this session from Melbourne:

https://www.ciscolive.com/online/connect/sessionDetail.ww?SESSION_ID=94624&backBtn=true

Re: Machine + User Auth for MAC OSX

Oliver Laue — Tue, 21 Mar 2017 07:21:08 GMT

Apple describes this in one of their own Guides.

macOS knows 3 Authentication modes.

System Mode = Machine Authentication

User Mode = user Authentication like iOS

as described in the document you can mix System Mode with Login Window Mode. But i've never configured it since the Login Window Mode needs an Authentication of a User against LDAP or Active Directory.

http://training.apple.com/pdf/WP_8021X_Authentication.pdf

Re: Machine + User Auth for MAC OSX

Craig Hyps — Tue, 28 Mar 2017 20:42:55 GMT

In general Mac OS will use System Profile or User Profile, but not both. Even if mixed System with Login, it would still be treated as separate authentications, so may be able to support MAR with its known limitations. Unless Apple adopts TEAP (RFC 7170), then you will not have a truly combined Machine+User auth based on 802.1X.

The CiscoLive session does discuss other ways to marry machine "identity" with user identity. Options include:

Machine Access Restrictions (MAR)
CWA Chaining
EasyConnect (EZC) Chaining (requires adding Mac clients to AD)
User Auth + Posture (check for key files, services, processes, etc that are telltale signs of corp device)
User Auth + Profiler (for example, customer DHCP Class ID)
User Auth + Device Registration / Customer Attribute
User Auth + MDM/DM integration (registration in external manager indicates managed endpoint)
User Auth + MAC Lookup to external ID store
Implicit methods such as Multi-Factor Auth. For example, user required to enter credentials or provide biometric data to unlock device credentials/cert.

/Craig

Re: Machine + User Auth for MAC OSX

jaime.pedraza — Wed, 06 Feb 2019 16:24:17 GMT

Hi Craig,

I know this is a rather old post but, do you have the number of the session to search it on cisco live library?

Thanks!

James

Re: Machine + User Auth for MAC OSX

TitanAE — Tue, 25 Feb 2020 19:18:43 GMT

Could you please re-upload the video in question? I get a 404 error when I hit the page.