Beamflash Networks

Consumer of fine internet products. Cognitive spendthrift. Infrastructural pet coddler. He/Him.
@[email protected]

[Beamflash Networks @beamflash]

@merill Wouldn't it make sense for them to be using passkeys in Authenticator instead of synced passkeys?

[Beamflash Networks @beamflash]

@NathanMcNulty Of course A5 gets nothing again

[Beamflash Networks @beamflash]

@patio11 Factoring

[Beamflash Networks @beamflash]

@kamilkazani https://t.co/0PerIM81az

[Beamflash Networks @beamflash]

@MyNameIsMurray @freeradius A bigger problem is that Intune can and not infrequently did take half an hour to provision a certificate, it was easily the biggest bottleneck in return to service when replacing a device.

[Beamflash Networks @beamflash]

@MyNameIsMurray @freeradius We reset passwords and logged in as students during provisioning. Bonus points in that when they change their password later, the cert still works fine. That's a choice though, and I agree that in an ideal world you'd be able to provision a user cert without wires/onboarding SSID

[Beamflash Networks @beamflash]

@MyNameIsMurray @freeradius Same SSID, using Intune as the MDM. You just have one policy set to user and computer authentication. @jabbrwcky and I worked it out, he blogged it at https://t.co/zNLpAXCHYI

[Beamflash Networks @beamflash]

@MyNameIsMurray @freeradius I would argue that accepting the one-time pain of Ethernet onboarding is worth it vs ongoing disabling of credential guard and MFA for EAP-TTLS/PAP. And you can have different user vs device policies with EAP-TLS.

[Beamflash Networks @beamflash]

@MyNameIsMurray @freeradius The missing piece is the device trying TEAP but not having a user certificate yet, only ISE and ClearPass can handle that case which is needed for onboarding. Standard EAP-TLS with device or user certificate only does work once you onboard via Ethernet, and I've done it in prod

[Beamflash Networks @beamflash]

@MyNameIsMurray @freeradius Working link https://t.co/2ixyJsfoml (the W got capitalised somehow in my previous link)

[Beamflash Networks @beamflash]

@MyNameIsMurray @freeradius Yes, that's the thing, it's technically non-standard and only implemented by ClearPass and ISE. Mist, Extreme and FreeRADIUS don't do it, they only implement RFC standard TEAP (device and user chained TLS cert auth success).

[Beamflash Networks @beamflash]

@freeradius @MyNameIsMurray I must have misunderstood it or the mailing list when I read them a few months ago. Could it be an implementation decision to send success with different attributes if the supplicant only sends one certificate?

[Beamflash Networks @beamflash]

@MyNameIsMurray @freeradius Sure, but that relies on the RADIUS server providing success with machine pass/user fail, otherwise with no user certificate the user gets dropped to desktop with no connectivity and no way to get a certificate
https://t.co/kHiSZrv89k

[Beamflash Networks @beamflash]

@MyNameIsMurray But don't let that stop you from doing TEAP right now, just be aware that you'll need to do first login wired or with an onboarding wifi network for the user to get their certificate

[Beamflash Networks @beamflash]

@MyNameIsMurray The RFC standard version of TEAP doesn't cover device pass/user fail, and FreeRADIUS is a stickler for RFC compliance. There is an updated RFC in the works that allows for it.
https://t.co/sZhCftvGSX

[Beamflash Networks @beamflash]

@MyNameIsMurray FreeRADIUS can't do device success/user fail for TEAP, which is what your want for onboarding. So far only ISE and ClearPass do it.

[Beamflash Networks @beamflash]

@patio11 That statement is giving me real https://t.co/OBakIOlppK vibes

[Beamflash Networks @beamflash]

@rucam365 I think the biggest hassle to doing it securely is how to manage them securely, what needs to be done to isolate them from regular Intune admins? Other replies note that VDI/AVD/W365 meets the user desktop need.