Overview Of The User Credentials Tab; Client Certificates; Usernames And Passwords - Cisco AIR-CB21AG-W-K9 Installation And Configuration Manual

Chapter 3 Configuring EAP Types

Overview of the User Credentials Tab

The EAP-FAST module supports the use of both a client certificate and a username and password as user
credentials for authentication and provisioning.

Client Certificates

If a client certificate is used, the EAP-FAST module automatically obtains the client certificate from the
Windows certificate store of the current user. The EAP-FAST module finds the user certificate that
matches the username of the user who is logged on. The certificate cannot be expired.
If multiple user certificates are available, the EAP-FAST module prompts the user to select one, and that
selection is saved to the profile. By default, the user certificate is sent securely through TLS
renegotiation or through the EAP-TLS inner method in the protected TLS tunnel. If the EAP-FAST
server does not start TLS renegotiation to request the client certificate after the tunnel is established, then
the EAP-FAST module sends the certificate through the EAP-TLS inner method.
The EAP-FAST module administrator can configure the EAP-FAST module XML schema to send the
user certificate without using these security measures.

Usernames and Passwords

If a username and password are used, the user provide one of the following types of username and
password:
•
•
•
•
Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration Guide for Windows Vista
OL-16534-01
Windows username and password—The Windows username and password are used as network
access credentials. The user is not prompted to enter the username and password unless the password
is invalid or must be changed.
Prompted user credentials—The user is prompted during authentication for credentials. These
credentials are credentials that are separate from the Windows username and password, such as
Lightweight Directory Access Protocol (LDAP) credentials.
Saved user credentials—These are user credentials that are entered as part of the EAP-FAST
configuration. The user is not prompted for credentials during authentication unless the saved
credentials fail or have expired. New credentials that the user enters after successful authentication
are saved automatically in the configuration. The user does not have to return to the configuration
screen to change the old saved credentials.
One-time password (OTP)—The user must manually enter a OTP. New PIN mode and next token
mode for OTP are supported.
Configuring EAP-FAST
3-9