Authentication using username-password/certificates by ISE

[raksec]

Hello,

We have a use case where users should be authenticated by username-password/certificates both simultaneously for Windows/Mac. Is this possible?

Thanks,

Rakesh Kumar

[Jason Kunst]

Please explain further your exact needs and why:
We already have EAP chaining for windows that ties together machine and user credentials with Anyconnect NAM
For Mac and windows You can do machine certificates with CWA chaining

[raksec]

Not talking about EAP-chaining which combines user/machine authentication. Here is the use case:

• Authenticating users by using password and certificates both simultaneously for windows/mac.
• Authenticating machines by using password and certificates both simultaneously for windows/mac.

[Mike.Cifelli]

You have several security protocols that you can use to accomplish either/or. From a security standpoint you are better off using certificates with eap-tls. Why couldnt you enforce CAC authentication to the domain that authenticates the user based on user principal name, and then implement NAM to auth the computer via certificate and the user either with cert or common access card.

[Jason Kunst · Accepted solution]

Supplicants only send 1 or the other at a time. You can do machine auth before login and then user auth upon login (windows). Please explain further why and how

[Mike.Cifelli]

If that is directed at me I missed the simultaneously piece. However, if there are already solutions available to auth both users & comps via certificates I dont see a benefit to adding username/pass. Just my opinion. Regardless, I dont know enough about the requirements to provide more details.

[raksec]

Guys, 

First of all, my use case is not related to EAP-chaining. This is similar to what works for anyconnect where ASA validates the user's certificate first, then checks with RADIUS server to validate user's password. 

Let me try again to explain the customer's requirement again.

User 'John' has a corporate laptop. For instance, keep laptop authentication out of this. When John tries to connect to network, he should be authenticated by his password as well as certificate provided to him. ISE should be able to validate both types of credentials.

[hslai · Accepted solution]

Jason already answered. ASA supports multiple authentications combining with user/machine certificate for remote-access VPN connections while ISE is supporting mostly single authentications, except for EAP chaining and CWA chaining for wired and wireless.

I agreed with Mike.Cifelli that using MFA, such as smart cards (e.g. CAC cards), is the way to go.

[raksec]

Understood, thank you all.