802.1x User Authentication Config Profile issues

I am interested to see the outcome of this. I need to use 802.1x, EAP chaining and AD certificates for 2 factor auth. Currently waiting for a hot fix to be applied to one of our CAs so that the AD Certificate payload will work properly.

I see that you have stated your selection for protocols (peap) but no mention of trusted certs? In my configs, I do not put "LDAPuser" in the username field but I do use the directory authentication option. If you are binding the computer to AD, one other thing to consider is that it was mentioned in another post in JAMF Nation (can't find it right now) that when binding the computer, try to bind it directly to the target OU and not bind then move it. Hope this helps a little!

We have roughly the same setup in our 802.1x profile as you do with the exception of the username field, which we leave blank. We also do not use a Login Window payload and have no issues connecting. Do you actually leave an entry filled in for the username field and deploy the profile with it, or no?

The "LDAPuser" is a management account I use to keep the machine logged in prior to the user logging in. I also had to add a trusted cert to the machine to get things working properly.
Essentially this got me up and running.
Trusted cert, management account to keep machine logged in when user has not logged in. When a person logs in, the authentication switches to them and puts them down the right VLAN. May be an odd deployment but it's working for me.

Why do you prefer to use a static LDAP account vs the computer directory authentication? Does it work better in your environment? Have you had a chance to edit your binding (if it isn't set this way already) to put your computers directly to their working OU? In a passing thought, is your mac computer OU nested? I think we were having problems due to that, but it has been a long time since then and I may be wrong....

I was having the static account during the login screen to keep the device connected wirelessly for management purposes. the config would still use the users information to re-authenticate and put them on the right VLAN once they reached their desktop. I did it this way because when I attempted to use directory authentication, it would always push an error that the account was not valid even though the machine was bound to the network.

As for the OU situation. I had the binding put the machine in it's proper OU so I would not have to move them later. This is working properly.

The only problem I had with this layout is if there was ever a time in which the wireless was interrupted for the user, it was rely on the system ldap account and reconnect. This is a problem because it would lay them into the wrong VLAN while they were logged on.

I ended up scrapping this idea and now working on computer certs that require user auth at login to see if this will work better.