Configuring Single Sign-On For Eap-Fast; Configuring Machine Authentication For Peap-Gtc; Configuring Single Sign-On For Peap-Gtc And Leap - Cisco AIR-CB21AG-W-K9 Installation And Configuration Manual

Chapter 4 Performing Administrative Tasks

Configuring Single Sign-On for EAP-FAST

SSO is supported by Microsoft Windows Vista in the following ways:
•
•
•
If network credentials are stored in the configuration, the EAP-FAST module has access to these
credentials before the user logs in to Microsoft Windows Vista.

Configuring Machine Authentication for PEAP-GTC

The PEAP-GTC module supports machine authentication only via the machine password. The
PEAP-GTC module gets the machine password from Windows through Microsoft's Local Security
Authority (LSA) API. The user is not prompted for the password.
Machine authentication is enabled and configured on the supplicant.

Configuring Single Sign-On for PEAP-GTC and LEAP

For both the PEAP-GTC module and the LEAP module, single sign-on (SSO) is supported by Microsoft
Windows Vista in the following ways:
•
•
•
•
•
Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration Guide for Windows Vista
OL-16534-01
Windows user credentials are passed to the EAP-FAST module through the EAPHost interface. The
system does not prompt the user to provide additional credentials if the EAP-FAST module is
configured to use Windows user credentials for network authentication and if the network profile is
configured for single sign-on.
Non-Windows network credentials are collected during the Microsoft Windows Vista logon process.
The EAP-FAST module requests the logon module to prompt the user for these network credentials.
If necessary, the EAP-FAST module is able to prompt the user for additional network credentials
before the user logs in to Microsoft Windows Vista.
Windows user credentials are passed to the module through the EAPHost interface. The system does
not prompt the user to provide additional credentials if the module is configured to use Windows
user credentials for network authentication and if the network profile is configured for single
sign-on.
Non-Windows network credentials are collected during the Microsoft Windows Vista logon process.
The module requests the logon module to prompt the user for these network credentials.
The Windows 802.1X supplicant handles the Group Policy process and ensures that it is
synchronized and exercised with the Window's logon process.
If necessary, the module is able to prompt the user for additional network credentials before the user
logs in to Microsoft Windows Vista.
If network credentials are stored in the configuration, the module has access to these credentials
before the user logs in to Microsoft Windows Vista.
Using Microsoft Tools to Perform Administrative Tasks
4-5