Cisco Systems CB21AG, PI21AG manual Configuring Single Sign-On for EAP-FAST

Chapter 4 Performing Administrative Tasks

Using Microsoft Tools to Perform Administrative Tasks

Configuring Single Sign-On for EAP-FAST

SSO is supported by Microsoft Windows Vista in the following ways:

•Windows user credentials are passed to the EAP-FAST module through the EAPHost interface. The system does not prompt the user to provide additional credentials if the EAP-FAST module is configured to use Windows user credentials for network authentication and if the network profile is configured for single sign-on.

•Non-Windows network credentials are collected during the Microsoft Windows Vista logon process. The EAP-FAST module requests the logon module to prompt the user for these network credentials.

•If necessary, the EAP-FAST module is able to prompt the user for additional network credentials before the user logs in to Microsoft Windows Vista.

If network credentials are stored in the configuration, the EAP-FAST module has access to these credentials before the user logs in to Microsoft Windows Vista.

Configuring Machine Authentication for PEAP-GTC

The PEAP-GTC module supports machine authentication only via the machine password. The PEAP-GTC module gets the machine password from Windows through Microsoft’s Local Security Authority (LSA) API. The user is not prompted for the password.

Machine authentication is enabled and configured on the supplicant.

Configuring Single Sign-On for PEAP-GTC and LEAP

For both the PEAP-GTC module and the LEAP module, single sign-on (SSO) is supported by Microsoft Windows Vista in the following ways:

•Windows user credentials are passed to the module through the EAPHost interface. The system does not prompt the user to provide additional credentials if the module is configured to use Windows user credentials for network authentication and if the network profile is configured for single sign-on.

•Non-Windows network credentials are collected during the Microsoft Windows Vista logon process. The module requests the logon module to prompt the user for these network credentials.

•The Windows 802.1X supplicant handles the Group Policy process and ensures that it is synchronized and exercised with the Window’s logon process.

•If necessary, the module is able to prompt the user for additional network credentials before the user logs in to Microsoft Windows Vista.

•If network credentials are stored in the configuration, the module has access to these credentials before the user logs in to Microsoft Windows Vista.

Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration Guide for Windows Vista

OL-16534-01 4-5