配置基于凭据的 （EAP-TTLS） 身份验证

Now, what else could we do with an IDP? We've already established that if we are using certificates or tell us to authenticate, we could use IDP and an additional source of information or context about the user. So namely, group memberships. Now, what about the authenticating users themselves without certificates?

What about authenticating users using usernames and passwords? We could leverage the existing connector with Azure to do EAP-TTLS authentication. With EAP-TTLS, the clients are using usernames and passwords to authenticate, as opposed to client certificates. So we can create another rule. We could say we are matching on the wireless user that is using TTLS instead of TLS.

And let's also match on the employee group. Why not? So we'll call it credential authentication - no - show authentication employees. Now, we will assign them to corporate VLAN. We'll hit Save. One thing we need to make sure that on the Azure portal on the app that we've created previously, there's one requirement for password authentication to work, you'll need to enable public client flows. Just click yes right here under authentication. You'll hit save.

And now we can go and check our client device. Let's take a look at the Windows device, how we can configure a Windows device to use TTLS. So we'll connect to mist-secure-net SSID. We'll be immediately prompted by the system to provide our username and password. So I'm going to give my full username and password. The important piece is to provide the full domain name - microsoft.com.

This is how the access assurance will find out which identity provider to talk to based on the domain name after the user. So click OK. Ask us to connect. And we're not connected using username and password. Now, let's take a look at our client events.

Let's look at the client insights. What we're seeing here is a slightly different flow because we are using usernames and passwords, we are not dealing with client certificates here. But the client is still trust in the server certificate. That's mutual trust is still there.

Now, we are going immediately to the identity provider to do the authentication to validate the credentials of that specific user. Now, after this phase is successful, we'll go ahead and look up all the user groups, the user roles from Azure, and finally we are matching on a specific authentication policy rule which we've just created to match on our new condition when clients are using TTLS.