1

Question is pretty much in the subject line.

I’d like to use AD & NPS & RADIUS to authenticate wifi users but I can’t reliably deploy certs or special config to the client machines.

Ideally I’d like the user to click on the SSID, enter their domain user name and password and get connected, whether they are domain joined or not.

Is this possible with NPS RADIUS?

I’ve had no success and have seen some articles suggesting this is possible, and some suggesting otherwise.

Thanks for any guidance!

3 Spice ups
2

I have non domain joined computers connecting to my network with user/password, but I have to manually create the wireless profile to tell it to ignore certs and to use user authentication otherwise it just tries to use computer or windows login by default.

2 Spice ups
3

Yeah that was my experience too.

I’d just insist on domain joining every company computer and deploy certs and then push all non-domain computers off onto a guest network (I’d know that they were all personal machines if they didn’t have the cert anyway) but the problem then would be what to do with devices that are company owned but aren’t domain joinable, e.g. android & IOS. I’m sure there are ways of setting them up but if it involves configuring one client at a time its not appealing to do (or ask users to do) for a zillion smartphones.

Are there ways of having APs (I’m using Unfi APs) authenticate through AD without jumping through cert hoops? Some other RADIUS server? Something other than RADIUS?

4

As far as iOS it asks for credentials then pops up the certificate that you can tell it to ignore… real easy. Android does essentially the same thing.

1 Spice up
5

Ah - that actually seems a bit more feasible for untrained users - they will click ignore to anything!

I’ll be honest I have no experience with NPS, just trying to configure RADIUS - what is the certificate that the client is being asked to consider? Is it a cert for the NPS server itself? Is it possible to obtain a cert that the client will “already” trust (without being explicitly told to), e.g. some sort of paid certificate?

6

Its a certificate that resides on the RADIUS (Microsoft NPS) Server.

I haven’t tried to implement a 3rd party cert, but it seems possible… I dont know if this will work, but I did come across this … - Airheads Community

1 Spice up