Apple Problems - 802.1x and Wireless (Shaky Login Window)

Bump

Nobody?

Are you doing your 802.1x using a mobileconfig profile?

Yes I am.

as @mnaylor mentioned, post your 802.1x profile. Sounds like you are caught in a login loop.

@chris.morelock The problem sounds like you're authenticating the machines with the student's credentials, and if they're set to require a password change that doesn't work. Try setting your 802.1x configuration profile to enable "Use Directory Authentication" and disable "Use as Login Window configuration". This will allow your laptops to connect to the wireless network using the machine's AD credentials for 802.1x, and switch to the user's credentials once they're logged in (and changed their password if needed).

I am going to give this a shot. Thank you @sdagley

@chris.morelock Any luck? There's a new post in the thread 802.1x PEAP Ethernet AD settings that suggests there may be an issue with JSS created network configuration profiles, and using Profile Manager to create a .mobileconfig you package and deploy via a Policy is the workaround (the thread mentions Apple Configurator 2, but I think they meant Profile Manager for Mac settings)

Sorry for the delay. Yes! Changing to machine auth has fixed the problem. I cannot thank you enough for this suggestion. YOu figured out what Apple and Cisco could not! I owe ya a beer!

When using machine authentication we lose the logged in user information in ClearPass. We want to be able to see the user's who are logged in and to which WAP they are on.

We get the user information in ClearPass when we select "Use a Login Window Authentication". However then users have to become familiar with a different login window because of the WiFi drop down AND new users logging in for the first time are not authenticating with AD on a previously bound machine as you described originally. Where they can authenticate as a new user if hard wired.

So my question here is; Is there any way to gather the logged in user information specifically in ClearPass, when using machine authentication?

I say specifically in ClearPass only because I know I can gather logged in user information with Jamf, but narrowing down which WAP on campus they are using in ClearPass would take some cross referencing.

TIA for any insight.

@FastGM3 This sounds like a question for Aruba (although someone else on JamfNation that's familiar with ClearPass may chime in). Depending on your organization's requirements for connecting devices to your network you may not want to have a machine connected without a logged in user. That's the policy for the org I'm with now, and machine auth is not allowed.