Connecting Mac Os To Microsoft Protected Eap


Set up Microsoft PEAP in OS X | 7 comments | Create New Account
Click here to return to the 'Set up Microsoft PEAP in OS X' hint

Sep 17, 2018  - Choose a network authentication method: Microsoft: Protected EAP (PEAP) and click the Settings button. If you put a check in the box next to Cache user information for subsequent connections to this network Windows will save your username and password and allow you to connect.

The following comments are owned by whoever posted them. This site is not responsible for what they say.

Question: when you got the .cer to import into your keychain, was it expired? I'm finding that my cert is expired by a couple minutes every time I download it. Is that normal?
Also, airport is not seeing the wireless network by default, I have to type it in. Was your machine seeing the wireless network? Also, I can't specify that I want to login using EnterpriseWAP in the 802.1x configuration. Does it just know this by default?
When you pulled down edit configurations, was the login/pw already filled in? should it be?
I'd like to just double check that the outer identity should be Domainloginid, no '/', no '@'... does Domain need to be capitalized? did it matter?
Thank you for this!
(I'd post what our hardware/software is but I don't know. I'm an end user searching desperately for help)

Darn it! I don't see a way to edit my above post.
I forgot to add that when I click connect, the status changes to 'Connecting' and freezes there for a while, and the button changes to 'disconnect'
does this have any meaning? Does this mean it sees the network but is freezing up (probably trying to authenticate with an expired cert which is my ignorant and naive opinion)

Set up Microsoft PEAP in OS X - worked for anyone else?

Has anyone else found this to work for them ?
(Did you do anything differently?)
Please post as much detail as possible.

Set up Microsoft PEAP in OS X - worked for anyone else?

Thanks for the tip, worked like a charm.
To eliminate some confusion on step 4
4: On the sheet that pulls down, select PEAP and then configure and enter your domain and loginid (Domainloginid) in the box marked 'Outer Identity.'
Note: Or in the case of windows 2000+, username@domainname

Set up Microsoft PEAP in OS X - worked for anyone else?

This worked for me. Note that I do not put in the domain name...
I just did <UserName> then <password> and clicked continue when it said 1 certificate couldn't be verified.... the <domain><username> or <username>@<domain> wasn't needed. (maybe the cert does this for me.)
Also our access points don't have broadcasted SSIDs and it still works =)
(OS X 10.4 on a Powerbook 17')

Trying this under 10.4.3, but am finding that authentication no longer works with any variation on the domain + username combinations.
Windows XP SP2 clients work fine.
Infrastructure: Windows 2003 AD, IAS, CAs.
Wireless hardware: Linksys WRT54G v 4.20.7
---
lumine.net

Worked it out finally...

PEAP profile information should contain only userid (not domain) as I was getting the error:

User domainuserid was denied access.
Fully-Qualified-User-Name = DOMAINdomainuserid

Putting in only the userid fixed that error immediately.

The second error I was having was that the Wireless Connection Remote Access Policy was being overriden by an existing VPN users RAP. Changing the priority order fixed that error.

All is good now...

---
lumine.net

-->

This article provides a step-by-step guide for creating an Extensible Authentication Protocol (EAP) configuration XML for a VPN profile, including information about EAP certificate filtering in Windows 10.

Create an EAP configuration XML for a VPN profile

To get the EAP configuration from your desktop using the rasphone tool that is shipped in the box:

  1. Run rasphone.exe.

  2. If you don't currently have a VPN connection and you see the following message, select OK.

  3. In the wizard, select Workplace network.

  4. Enter an Internet address and connection name. These can be fake since it does not impact the authentication parameters.

  5. Create a fake VPN connection. In the UI shown here, select Properties.

  6. In the Test Properties dialog, select the Security tab.

  7. On the Security tab, select Use Extensible Authentication Protocol (EAP).

  8. From the drop-down menu, select the EAP method that you want to configure, and then select Properties to configure as needed.

  9. Switch over to PowerShell and use the following cmdlets to retrieve the EAP configuration XML.

    Here is an example output.

    Here is an example output.

    Note

    You should check with mobile device management (MDM) vendor if you need to pass this XML in escaped format. The XSDs for all EAP methods are shipped in the box and can be found at the following locations:

    • C:WindowsschemasEAPHost
    • C:WindowsschemasEAPMethods

EAP certificate filtering

In your deployment, if you have multiple certificates provisioned on the device and the Wi-Fi profile provisioned does not have a strict filtering criteria, you might see connection failures when connecting to Wi-Fi. The solution is to ensure that the Wi-Fi profile provisioned has strict filtering criteria so that it matches only one certificate.

Enterprises deploying certificate-based EAP authentication for VPN and Wi-Fi can encounter a situation where there are multiple certificates that meet the default criteria for authentication. This can lead to issues such as:

  • The user might be prompted to select the certificate.
  • The wrong certificate might be auto-selected and cause an authentication failure.

Connecting Mac Os To Microsoft Protected Eap Download

A production ready deployment must have the appropriate certificate details as part of the profile being deployed. The following information explains how to create or update an EAP configuration XML such that the extraneous certificates are filtered out and the appropriate certificate can be used for the authentication.

EAP XML must be updated with relevant information for your environment. This can be done manually by editing the following XML sample, or by using the step-by-step UI guide. After the EAP XML is updated, refer to instructions from your MDM to deploy the updated configuration as follows:

  • For Wi-Fi, look for the <EAPConfig> section of your current WLAN Profile XML. (This is what you specify for the WLanXml node in the Wi-Fi CSP.) Within these tags you will find the complete EAP configuration. Replace the section under <EAPConfig> with your updated XML and update your Wi-Fi profile. You can refer to your MDM’s guidance on how to deploy a new Wi-Fi profile.
  • For VPN, EAP configuration is a separate field in the MDM configuration. Work with your MDM provider to identify and update the appropriate field.

Microsoft Protected Eap Peap

For information about EAP settings, see https://technet.microsoft.com/library/hh945104.aspx#BKMK_Cfg_cert_Selct.

For information about generating an EAP XML, see the EAP configuration article.

For more information about extended key usage (EKU), see http://tools.ietf.org/html/rfc5280#section-4.2.1.12.

For information about adding EKU to a certificate, see https://technet.microsoft.com/library/cc731792.aspx.

The following list describes the prerequisites for a certificate to be used with EAP:

  • The certificate must have at least one of the following EKU properties:

    • Client Authentication. As defined by RFC 5280, this is a well-defined OID with value 1.3.6.1.5.5.7.3.2.
    • Any Purpose. This is an EKU defined and published by Microsoft, and is a well-defined OID with value 1.3.6.1.4.1.311.10.12.1. The inclusion of this OID implies that the certificate can be used for any purpose. The advantage of this EKU over the All Purpose EKU is that additional non-critical or custom EKUs can still be added to the certificate for effective filtering.
    • All Purpose. As defined by RFC 5280, if a CA includes EKUs to satisfy some application needs, but does not want to restrict usage of the key, the CA can add an EKU value of 0. A certificate with such an EKU can be used for all purposes.

  • The user or the computer certificate on the client must chain to a trusted root CA.

  • The user or the computer certificate does not fail any one of the checks that are performed by the CryptoAPI certificate store, and the certificate passes requirements in the remote access policy.

  • The user or the computer certificate does not fail any one of the certificate object identifier checks that are specified in the Internet Authentication Service (IAS)/Radius Server.

  • The Subject Alternative Name (SubjectAltName) extension in the certificate contains the user principal name (UPN) of the user.

The following XML sample explains the properties for the EAP TLS XML, including certificate filtering.

MacConnecting Mac Os To Microsoft Protected Eap

Note

For PEAP or TTLS profiles, the EAP TLS XML is embedded within some PEAP-specific or TTLS-specific elements.

Connecting Mac Os To Microsoft Protected Eap Software

Note

The EAP TLS XSD is located at %systemdrive%WindowsschemasEAPMethodseaptlsconnectionpropertiesv3.xsd.

Alternatively, you can use the following procedure to create an EAP configuration XML:

Connecting Mac Os To Microsoft Protected Eap Free

  1. Follow steps 1 through 7 in the EAP configuration article.

  2. In the Microsoft VPN SelfHost Properties dialog box, select Microsoft: Smart Card or other Certificate from the drop-down menu (this selects EAP TLS).

    Note

    For PEAP or TTLS, select the appropriate method and continue following this procedure.

  3. Select the Properties button underneath the drop-down menu.

  4. On the Smart Card or other Certificate Properties menu, select the Advanced button.

  5. On the Configure Certificate Selection menu, adjust the filters as needed.

  6. Select OK to close the windows and get back to the main rasphone.exe dialog box.

  7. Close the rasphone dialog box.

  8. Continue following the procedure in the EAP configuration article from step 9 to get an EAP TLS profile with appropriate filtering.

Note

Protected Eap Settings

You can also set all the other applicable EAP Properties through this UI as well. A guide for what these properties mean can be found in the Extensible Authentication Protocol (EAP) Settings for Network Access article.

Comments are closed.