Skip to main content
Question

EAP-TLS (Wired or Wireless) Prompting for Admin Account When Connecting

  • February 2, 2015
  • 2 replies
  • 21 views
ndelgrande
Forum|alt.badge.img+5

Hi all,

We are moving to EAP-TLS on wireless and wired, but because the workstations unique certificate and the rest of the chain is in the System Keychain, an admin prompt is popping up when connecting. I am pushing the certs out using the "AD Certificate" Configuration Profile which pulls the certificate from an Active Directory Certificate Server. SCEP is not an option. Is there any way to use machine level authentication with EAP-TLS for non admin users? This is a big show stopper for us since not all our Mac users are admins.

    2 replies

    M
    Forum|alt.badge.img+8
    • michaelhusar
    • Valued Contributor
    • February 3, 2015

    We use EAP-TLS just for Wifi:
    I have a Profile to distribute the Wifi settings: It holds 3 certs to cover the whole chain (wifi-cert, access-point - cert, CA-cert). Network-payload: "protocols": EAP-Type: TLS is checked, no username, identity cert is set to the wifi-cert; under "trust" the access-point and the CA-cert are listed and checked; under cert-names the wifi-cert-name and the access-point-cert-name are entered
    Maybe check also your wifi-identity-cert: since it is secured with a password (pkcs12) it "looks" different than the other certs: "No information can be displayed"

    A
    Forum|alt.badge.img+18
    • alexjdale
    • Contributor
    • February 3, 2015

    We also store the chain certs on the System keychain, but make sure you have explicitly set trust on them (we set trust for SSL and EAP). We don't have issues with admin prompts.

    Terms & ConditionsCookie settingsAccessibility statement