802.1X Authentication Issue

[ruihere]

Hi, I am trying to setup 802.1X authentication for our ethernet and wifi network. with JSS configuration profiles, I setup Certificate(RootCA), AD and Network. I was able to get the certificate from our Root CA. (the cert it gets is like hostname.ad.corp. , the FQDN, I asked my enterprise team, they said the cert must to have FQDN, but he can add UPN as well). however it cannot connect with the correct 802.1X profile.

On wired network, I have to manually choose the 802.1X profile from wifi, and then type the machine name + $ to get authenticated. On wifi, I just cannot get authenticated, is said authentication server is not responsing.

On the network payload, username to authenticate the network, I tried using $ComputerName, %ComputerName%$, and $ComputerName$. But none working. not sure if that is the issue?

I tried reading the eapclient log, seems not much help.

I searched the silimiar topics on JSS and internet, and then tried using Apple Profile Manager, however when I manually import the mobileconfig file, it shows the dialogue that my cert authority is asking for username and password ?

Thanks!

[PhillyPhoto]

For our network profile, I created the profile in the profile manager on Server, then manually signed the profile in Terminal before uploading it to our JSS. The JSS alters the profile if you upload it unsigned and corrupts some of the configuration.

I have since moved to a PKG install for easier AD certificate renewal when their machine cert expires. It doesn't require scoping issues for automatic installs and we were having issues with profiles being randomly removed from machines for some reason. So I still use the same signed profile from above, but just deliver it via PKG. That also lets me remove old certificates at the same time.

[ruihere]

I also tried using profile manager, but when I tried to add the profile, it asked for my root cert authority username/password to enroll?

[PhillyPhoto]

This is my workflow in Profile Manager:

1. Go to Profile > Device Groups > Click + to create a new one, and name it > Click Save
2. Go to General Settings and give it a name
3. Configure the AD Certificate server
4. Add our Secure CA cert
5. Configure the network settings
6. Configure VPN
7. Click OK > Click Save > Click Download
8. Sign that profile in terminal

[ruihere]

Thanks, @PhillyPhoto , I realized that my cert url is http://FQDN, but yours is https://FQDN/cersrv.

After changing that, I was able to let wifi profile working! yeah!!! thanks :)

however the ethernet still asking me for system username/password for "Enter settings for the enterprise network "Wired 802.1X"

[bjharper]

@ruihere When building the config profile in Jamf, do you have the box checked to use Directory Authentication under the Network payload settings? If your machines are bound to AD, this should use computer creds to authenticate rather than prompting for user creds.

[ruihere]

@bjharper I was using Apple Profile Manger to create the profile, I use TLS, so no choice to "Use Directory Authentication". however if I choose PEAP or other options, I can see using this option.

[dstranathan]

Couple quetions:

1. In your AD Certificate payload (Step 3), is the CA your Root CA or an Intermediary CA?
2. Can this profile (and related payloads) be built 100% in the JSS (i.e.; not macOS Server)?

Thank you

[AHolmdahl]

@PhillyPhoto I'm also getting the same "ethernet still asking me for system username/password" dialog.
I am also creating the profile with Apple Profile Manager but I always get the the same "ethernet still asking me for system username/password" dialog... I am about to go crazy... what possible thing/checkbox/information have I missed?
I´d be super grateful for any help...

@dstranathan 2. as phillyphoto mentioned - Apparently the only way to get the 802.1x wired profile to work is to use Apples Profile Manager, download the profile, sign it and upload it to the JSS.

[PhillyPhoto]

@AHolmdahl are you using anything like "host/%ComputerName%.domain.com" under TLS like in my screenshot?

[DSI]

Try this :

[cleverleys]

I have got this working this week using Jamf Pro. @bjharper is correct, you need to use directory authentication and not enable the username & password option. The client AD object is what authenticates through radius for us - not users.

[cleverleys]