(BYOD) Using EAP Cert Common Name to confirm valid AD account.

[Scott Gillies]

Hi

I have a BYOD service that uses Active Directory (AD) to autenticate users to allow them to on-board and obtain a user EAP cert, the common name on the issued cert being the username. Once on-boarded the EAPTLS connection to the network is transparent to the user and requires no further input.

As part of the authorization I also want to check that the cert common name (the users name) is also a current/valid username on the AD.

Is it possible to create an authorization policy that includes passively checking the validity of the username on the AD?

i.e. if (Wireless_802.1X AND EAP-TLS certificate:common name Equals valid AD:username)

Is this possible?

[Mike.Cifelli · Accepted solution]

What you are trying to accomplish can be setup this way:
Setup an External Identity Source - Certificate authentication profile. Within the profile, map the identity store to your active directory. Then use identity from certificate attribute of choice (common name).

Within your policy set setup your authentication conditions as you wish and set the result to use the certificate authentication profile you created. If you want to test this in somewhat of a passive mode you have a couple options. One scenario can be setting If auth fail AND/OR if user not found 'Continue'. I wouldn't recommend doing this as it decreases security. This will allow you to check the validity of the username in AD.

In your authz conditions you can set something up that verifies the certificate issuer-common name equals your sub-ca where you obtained your certificate. This looks like this:
CERTIFICATE:Issuer - Common NAME Equals <info>