Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

Client Onboarding Through a NAC Portal Using the Marvis Client App

Onboard your device to the HPE Mist Networking Access Assurance network securely by using Wi-Fi client certificates provisioned by the NAC onboarding portal through the Marvis Client app.

Onboarding a device through a Network Access Control (NAC) portal enables provisioning of Wi-Fi client certificates through the Marvis client app. The onboarding process uses a certificate authority that enables issuing of EAP-TLS client certificates to devices. These certificates are used by clients to authenticate to the HPE Mist Networking Access Assurance network using EAP-TLS (Extensible Authentication Protocol - Transport Layer Security).

The Marvis client app can be pre-installed on devices or downloaded directly from the NAC Onboarding Portal. The end user needs to authenticate to the NAC Onboarding Portal using their SSO credentials (Azure AD, Okta).

On successful authentication, the NAC portal (integrated with the enterprise IdP) provisions a device-bound X.509 client certificate and delivers a preconfigured Wi-Fi network profile, which should be installed within the Marvis Client app. Once the profile is installed, the app enables the device to seamlessly connect to the designated secure SSID using EAP-TLS.

This onboarding process eliminates manual PKI distribution and SSID configuration, while enforcing enterprise network access policies for unmanaged devices in a BYOD environment.

Benefits of Client Onboarding Through a NAC Portal

Onboarding a client through a NAC portal using the Marvis client app ensures secure, seamless, and password-less access to your organization’s Wi-Fi network. Traditional Wi-Fi connections using usernames and passwords are vulnerable to misuse, leaks, and manual errors. The NAC onboarding portal eliminates these risks by using certificate-based authentication issued only after validating your identity through your organization’s Single Sign-On (SSO) system.

In addition to ease of use, onboarding provides enterprise-grade security for BYOD (Bring Your Own Device), guests, and contractors, eliminating the need for IT intervention for every connection.

Onboarding a device to a NAC portal using the Marvis client app provides the following benefits:

  • A unique digital certificate tied to your identity and device.

  • Automatic installation of a secure Wi-Fi profile, requiring no manual setup.

  • Access governed by zero trust network policies defined in the HPE Mist cloud.

You can onboard Android, Windows, macOS, and iOS devices. Onboarding is supported on devices running:

  • Windows—Release 10 or 11

  • macOS—Sonoma (version 14) and later releases

  • Android—Android 12+

  • iOS—16 and later release

Before You Begin

Before proceeding to onboard a device, ensure to

  • Obtain and activate a HPE Mist Networking Access Assurance subscription. For information about subscription management, see the HPE Mist Management Guide.

  • Enable onboarding:

    1. From the left menu of the management portal, select Organization >Access>Certificates.

      The Certificate Authorities page appears.

    2. Click the settings icon on the upper-right corner of the page and select Onboard CA Configuration.

      Certificate Authorities page with no certificates listed, action buttons for adding or importing certificates, and highlighted Onboard CA Configuration and Certificates menu options.

    3. In the Onboard CA Configuration dialog box, select Active and click OK to enable the built-in CA to issue the client certificates.

      Onboard CA Configuration, set to Active, showing no certificates listed in the Certificate Authorities section with navigation menu on the left.

      When the Onboard CA Configuration is activated, you’ll see the following tabs displayed:

      • External—Displays the details of the external CAs.

      • Internal— Displays the details of client certificates issued by the built-in CA through the NAC portal or MDM.

        Certificate Authorities, showing management options with tabs for External and Internal authorities, empty table stating there are no Certificates, and buttons for adding or importing certificates. Navigation menu on the left includes Monitor, Clients, Access Points, Switches, WAN Edges, HPE Mist Networking Edges, Location, Analytics, Site, A/B Testing, and Organization.

  • Ensure that you have an IdP account with app integration capability. Your IdP can be any provider that supports SAML 2.0 integrations. Examples include Azure, Google, and Okta.

In this topic, we show you how to create a NAC portal and integrate it with Microsoft Azure and Okta.

How to Set Up a NAC Portal and Integrate It with Microsoft Azure

Setting up a NAC onboarding portal and integrating it with Azure involves the following steps:

Create a NAC Portal and Integrate It with Azure

Ensure that the onboard CA configuration is enabled on the Certificates page. See Before you Begin.

  1. Create a NAC portal. When you create the portal, a NAC portal URL will be generated for users to access using SSO.

    1. From the left menu of the management portal, select Organization>Client Onboarding, and select the NAC tab.

    2. Click Add NAC Onboarding Portal at the top-right corner of the Client Onboarding page.

    3. In the Add NAC Onboarding Portal page, provide a name and click Create.

      Add NAC Onboarding Portal with fields for Name set to Onboard-Portal and Portal Type set to Marvis Client. Create and Cancel buttons visible.

      The Edit NAC Onboarding portal page displays.

    4. Select the Portal Authorization tab:

      1. Enter placeholder values for Issuer, Certificate, and SSO URL. These values will later be replaced with actual values from the IdP.

      2. Copy the SSO Portal URL to use later.

        Configuration interface for editing NAC Onboarding Portal with Portal Authorization tab selected. Key fields include Issuer set to TEST, Name ID Format set to Email, Signing Algorithm set to SHA256, Certificate containing TEST, SSO URL set to https://test.com, and Portal SSO URL starting with https://api.ac5.mist.com/api/v1/nacportal/. Buttons at the bottom are Delete in red, Save, and Cancel.

    5. Select the Onboarding Parameters tab and configure the following:

      1. Enter the SSID name to be provisioned.

      2. Select the Security Type as WPA2 or WPA3 Enterprise.

      3. Set the number of days after which the client certificate will expire. The value can range from 1-1825 days (up to 5 years).

        Configuration interface for editing NAC Onboarding Portal on Onboarding Parameters tab. Wireless Connection SSID set to SCEP-DEMO and Security Type set to WPA2. Client Certificate expires in 365 days. Buttons: Delete red, Save blue, Cancel gray.

  2. Configure SSO and integrate the NAC portal with Microsoft Azure:

    1. Log into the Azure portal. Navigate to Enterprise Applications and click New Application.

    2. In the Browse Microsoft Entra Gallery section, type Mist Cloud Admin SSO in the search box.

    3. Select Mist Cloud Admin SSO from the results panel. Provide a name for the application and click Create.

      Microsoft Entra Gallery search for HPE Mist Cloud Admin SSO results in two applications

    4. Open the application and click Set up Single Sign-On.

      Enterprise application overview page in Microsoft Entra admin center for SCEP-DEMO, showing application details, navigation menu, and highlighted single sign-on setup step in Getting Started section.

    5. Select SAML as the SSO method.

    6. Click Edit Basic SAML Configuration.

      Configuration page for SAML-based single sign-on setup in Microsoft Entra for the application SCEP-DEMO. Sections include Basic SAML Configuration, Attributes and Claims, SAML Certificates, and a navigation panel.

    7. In the SAML configuration page, set the Identifier and Reply URL to the Portal SSO URL copied earlier from the NAC Onboarding Portal. Click Save.

      Configuration screen for setting up SAML-based Single Sign-On in Microsoft Entra for the SCEP-DEMO app, showing fields for Identifier, Reply URL, user attributes, token signing certificate, and Save button.

    8. Download the Certificate (Base64) and copy the Login URL and Microsoft Entra Identifier.

      Configuration page for SAML-based single sign-on in Microsoft Entra for the SCEP-DEMO application. Includes certificate details, setup URLs, verification certificates, and test single sign-on options. Highlighted elements emphasize download links and login identifiers.

    9. In the management portal, go to the Portal Authorization tab for your NAC Onboarding Portal:

      • Replace Issuer with the Microsoft Entra Identifier.

      • Replace Certificate with the payload from the downloaded Base64 certificate.

      • Replace SSO URL with the Login URL.

        NAC Onboarding Portal configuration interface on Portal Authorization tab showing identity provider setup. Issuer URL, Name ID Format set to Email, SHA256 Signing Algorithm, Base64 certificate payload, Microsoft Online SSO URL, and NAC portal API endpoint are displayed. Save, Delete, and Cancel options are at the bottom.

  3. Assign users and groups to the Azure application to enable them to access the portal.

Download the Marvis Client App and Wi-Fi Profile

After you configure the NAC portal and integrate it with Azure, users can log in to the NAC portal using Azure SSO and install the Wi-Fi profile through the Marvis client app. We've used a macOS device as an example here.

  1. On a macOS device, access the NAC Portal using the URL listed under the Portal Settings tab of the NAC Onboarding Portal and sign in using your Azure SSO credentials.

    After a successful authentication, the following page displays.

    macOS download prompt with buttons for app installation and links to terms, alongside a group discussion on a wooden deck with greenery.

  2. Click Download and Install App to install the Marvis client app.

    If your device is running Windows or macOS, the app is downloaded automatically and you can install the app once the download process is complete.

    For Android and iOS, you will be redirected to the Google or Apple Play Store to download the app.

  3. After you install the Marvis client app (or if you have installed the app already), switch to the NAC portal page and click Already have the app? to install the profile.

    You will be redirected to the Marvis client app to install the Wi-Fi profile.

  4. Click Install, and then navigate to Settings>General > Device Management on your device and complete the profile installation.

    Device Management window shows macOS system preferences with General selected and managed profiles listed including IDP-TEST, Onboard-Portal highlighted, macOS-TTLS-Profile, MobiControl Trust Profile, and MobiControl Management with unenroll option. MarvisClient window displays a message confirming profile installation completion with Finish button.

  5. In the management portal, open the Certificates page and verify the client-issued certificate details under the Internal section.

    internal certificate details including client name, serial number, device ID, validity dates, and certificate provider NAC Portal, with navigation menu on the left.

Verify Client Connectivity to the Network

Verify that the device connects to the Access Assurance network through the client certificate provisioned through the Marvis client app.

  1. From the left menu of the management portal, select Organization> Access>Auth Policies and configure the required authentication policy rules for the device.

    Auth Policies page for managing user authentication policies with options to add rules, create labels, and view policy details in a table format including rule number, name, match criteria, access policy, assigned policies, and hit count. Includes navigation sidebar and save or cancel buttons.

  2. Connect the device to the network and confirm successful authentication.

  3. Navigate to the Monitor>Service Levels>Insights page and go to the Client Events section. Verify the NAC Client authentication events.

    Network monitoring dashboard displaying client events and activity. Includes a graph of network activity over time, 197 client events categorized as good, neutral, and bad, timestamps, and detailed client information such as username, access point, MAC address, SSID, VLAN, certificate details, and authentication rules.

How to Set Up a NAC Portal and Integrate It with Okta

Setting up a NAC onboarding portal and integrating it with Okta involves the following steps:

Create a NAC Portal and Integrate It with Okta

Ensure that the onboard CA configuration is enabled on the Certificates page. See Before you Begin.

  1. Create a NAC portal. When you create the portal, a NAC portal URL will be generated for users to access using SSO.

    1. From the left menu of the management portal, select Organization>Client Onboarding, and select the NAC tab.

    2. Click Add NAC Onboarding Portal at the top-right corner of the Client Onboarding page.

    3. In the Add NAC Onboarding Portal page, provide a name and click Create.

    4. Select the Portal Authorization tab:

      1. Enter placeholder values for Issuer, Certificate, and SSO URL. These values will later be replaced with actual values from the IdP.

      2. Copy the SSO Portal URL to use later.

        Configuration interface for editing NAC Onboarding Portal with Portal Authorization tab selected. Key fields include Issuer set to TEST, Name ID Format set to Email, Signing Algorithm set to SHA256, Certificate containing TEST, SSO URL set to https://test.com, and Portal SSO URL starting with https://api.ac5.mist.com/api/v1/nacportal/. Buttons at the bottom are Delete in red, Save, and Cancel.

    5. Select the Onboarding Parameters tab and configure the following:

      1. Enter the SSID name to be provisioned.

      2. Select the Security Type as WPA2 or WPA3 Enterprise.

      3. Set the number of days after which the client certificate will expire. The value can range from 1-1825 days (up to 5 years).

        Configuration interface for editing NAC Onboarding Portal on Onboarding Parameters tab. Wireless Connection SSID set to SCEP-DEMO and Security Type set to WPA2. Client Certificate expires in 365 days. Buttons: Delete red, Save blue, Cancel gray.

  2. Configure SSO and integrate the NAC portal with Okta:

    1. Log in to the Okta administration console and navigate to the Applications page.

    2. Click Create App Integration.

      Okta Admin Console Applications section showing navigation menu, highlighted Applications tab, action buttons, search bar, app list with statuses, and account info.

    3. Select SAML 2.0 as the Sign-in method and click Next.

      User interface for app integration creation with sign-in options: OIDC, SAML 2.0 (selected), SWA, and API Services. Cancel and Next buttons, Learn More link.

    4. Enter an app name and click Next.

      Okta Admin Console Create SAML Integration page in General Settings step with fields like App Name set to SCEP-DEMO and App Logo.

    5. Paste the Portal SSO URL that you copied earlier to the Single Sign On URL and Audience URL fields under SAML Settings. Set the Name ID format to EmailAddress, click Next, and then click Finish.

      SAML Settings configuration page in Okta Admin Console showing fields for Single sign-on URL, Audience URI, Default RelayState, Name ID format set to EmailAddress, Application username set to Okta username, and update application username on Create and update. Left-hand menu includes navigation options like Dashboard, Directory, Applications, and Security.

      You will be redirected to the app in edit mode.

    6. Scroll down and click View SAML setup instructions.

      Admin Console interface showing Applications section highlighted in the sidebar, SAML setup details, certificate management options, and plan type with user and update info.

    7. Copy the Identity Provider Single Sign-On URL, Identity Provider Issuer, and X.509 Certificate.

      Configuration page for SCEP-DEMO with fields for Single Sign-On URL, Identity Provider Issuer URL, and X.509 Certificate in PEM format.

    8. Switch to the management portal and go to the Portal Authorization Settings tab of the Edit NAC Onboarding Portal page. Paste the information that you copied in the previous step in the following fields:

      Issuer—Identity Provider Issuer

      SSO URL—Identity Provider Single Sign-On URL

      Certificate—X.509 Certificate

      Editing screen for configuring NAC Onboarding Portal under Portal Authorization tab, with fields for IdP issuer, Name ID format, signing algorithm, X.509 certificate, SSO URL, portal SSO URL, and buttons to delete, save, or cancel.

      Click Save.

    9. Go to Applications>Assign Users to App and assign users.

      Okta Admin Console interface showing Assign Applications screen with navigation sidebar and main section displaying apps and users for assignment.

    10. Select the user and the application, then click Next.

    11. Click Confirm Assignments.

Download the Marvis Client App and Wi-Fi Profile

After you configure the NAC portal and integrate it with Okta, users can log in to the NAC portal using Okta SSO and install the Wi-Fi profile through the Marvis client app. We've used an iOS device as an example here.

  1. On your iOS device, access the NAC Portal URL listed under the Portal Settings tab of the Edit NAC Onboarding Portal page and sign in using your Okta SSO credentials.

  2. Click Download and Install App to install the Marvis client app.

    If your device is running Windows or macOS, the app is downloaded automatically and you can install the app once the download process is complete.

    For Android and iOS, you will be redirected to the Google or Apple Play Store to download the app.

  3. After you install the Marvis client app (or if you have installed the app already), switch to the NAC portal page and click Already have the app? to install the profile.

    You will be redirected to the Marvis client app to install the Wi-Fi profile.

  4. Click Install.

  5. In the management portal, open the Certificates page and verify the client-issued certificate details under the Internal section.

Verify Client Connectivity to the Network

Verify that the device connects to the Access Assurance network through the client certificate provisioned through the Marvis client app.

  1. From the left menu of the management portal, select Organization> Access>Auth Policies and configure the required authentication policy rules for the device.

    Auth Policies page in management portal for managing user authentication policies with options to add rules, create labels, and view policy details in a table format including rule number, name, match criteria, access policy, assigned policies, and hit count. Includes navigation sidebar and save or cancel buttons.

  2. Connect the device to the network and confirm successful authentication.

  3. Navigate to the Monitor>Service Levels>Insights page and go to the Client Events section. Verify the NAC Client authentication events.