Certificate templates for EAP-TLS

[rkazmierczak]

Hi,

Are there recommended user and device certificate templates, the ones used in Windows CA for example. I have seen diffrent ways of doing it - diffrent values for SAN field for example.

The reason I ask is that I am wondering how the device group membership in AD is checked with EAP-TLS. I suppose it's one of the LDAP attributes?  I'd like to use device group membership in the authorisation rules.

Thanks,

Rafal

[Craig Hyps · Accepted solution]

Typically the Cert Auth Profile specifies the certificate field that contains the user id in AD.  Often this the Subject CN.  This value is then used to fetch group memberships like we would for any other type of Authorization.  Optionally you can assign values to specific cert fields like OU to have additional policy conditions such as IF OU=DivisionX, THEN ...

Specific to LDAP queries, the LDAP server definition defines the attribute in LDAP used to perform group membership lookups.

/Craig

[rkazmierczak]

Hi Craig,

How about the device certificate? what should I put in the subject name and what should I match for in the certificate profile? and finally how will the hostname be "extracted" so that a search in the AD can be done?

Thanks,

Rafal

[Craig Hyps]

MAC address can be used.

[rkazmierczak]

is it possible to do a search for AD group membership based on MAC address?

[Craig Hyps]

yes, for LDAP.  For AD, it depends on how accounts are stored.  You could also set the FQDN or UPN in cert field.

[rkazmierczak]

thanks.