AnyConnect authentication using logged on credentials

[Mark Bowyer]

Hi,

Is it possible to configure AnyConnect to auto authenticate using the logged on users credentials? so they don't have to enter their username/password at Windows login and then again to connect via AnyConnect?

Thanks,

Mark

[Rob Ingram]

Hi,
No you cannot transparently pass the username/password credentials from the logged on user. If you don't want the users to enter their credentials, you could use user certificates for authentication to the ASA.
You can distribute the user certificates via GPO from AD (assuming you have an AD infrastructure), the certificate would be tied to the users AD account.

HTH

[Cristian Matei]

Hi,

   This is not supported at this point, probably will never be, due to security concerns. You can ease the "pain" on the user's side and increase your overall security by using double authentication (fist one certificate based, the second one username/password based), and pre-fill the username from a filed of the certificate, so they only need to enter their password.

Regards,

Cristian Matei.

[Mark Bowyer]

Using certificates sounds like a good plan. Is there a decent guide somewhere that explains the best way to set this up?

[Rob Ingram]

Here are some examples:-

https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/116111-11611-config-double-authen-00.html

https://community.cisco.com/t5/security-blogs/anyconnect-certificate-based-authentication/ba-p/3105546

http://www.labminutes.com/sec0127_ssl_vpn_anyconnect_client_certificate_double_authentication_1

[Cristian Matei]

Hi,

   In case you want to deploy double authentication, with certificates and username pre-fill, here's a guide to help you out:

https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/116111-11611-config-double-authen-00.html

Regards,

Cristian Matei.