NAC - Single sign-on?

[KarthiAruISS]

Hi,

The present authentication process is a three stage process as follows,

1. User logs in first by using the smart card (HID card and Navigo Software). (All the Windows OS based Desktop PCs are equiped with USB smart card readers. The Navigo software checks the login database and in turn authenticates the user accordingly. Windows Active Directory is also present.)

2. Next the user has to type the desktop username and password to log in to the desktop.

3. Next the user has to type the NAC username and password to log in.

The Cisco NAC brochures also mention support for SSO (Single Sign-on). How can the SSO be implemented in this scenario? i.e., Logging to NAC directly by just authenticating the Smart Card. Do let me know if additional details are required.

Thanks,

Karthi

[Tarik Admani]

Hi,

Single sign on is performed by using Kerberos once the client connects to the Kdc it should pull a Kerberos ticket for the Cas service account. Then the Nac agent helps the Kerberos ticket exchange in order to authenticate the client.

However all unauthenticated traffic must have access to all the single sign on ports...smb,ldap,global catalog...etc. ISE is the way to go. Cisco is offering discount for customers to migrate away from Nac. Let me know if you need help and I can hook you up.

Thanks,

Sent from Cisco Technical Support iPad App