Authentication Methods and Identity Sources
Methods
ClearPass supports PAP, CHAP, MS-CHAPv2, EAP-PEAP, EAP-TLS, EAP-TTLS, and EAP-FAST. The method must match what the supplicant and NAD negotiate. Traps: PEAP uses a server certificate and inner method (often MS-CHAPv2); EAP-TLS requires client certificates on both sides; PAP sends credentials in the clear inside the tunnel and is often used for web auth or LDAP binds.
Identity sources
Sources include Active Directory (Kerberos/MS-CHAPv2 or LDAP bind), LDAP, local users, SQL, and token servers (for MFA). Each source returns attributes used for authorization. Know that AD machine authentication and user authentication are distinct - a computer account authenticates differently than a user account.
Certificates
EAP-TLS and PEAP server validation rely on a server certificate on ClearPass and a trust chain on the client. Traps: an expired server cert breaks PEAP/EAP-TLS; clients must trust the CA; and the certificate CN/SAN must match what the supplicant validates.
Traps in questions
- Confusing the outer EAP method with the inner authentication method (PEAP outer, MS-CHAPv2 inner).
- Assuming MAC auth validates identity - it only identifies a device by MAC.
- Forgetting that AD group attributes drive role mapping.
- Mixing up user vs. machine authentication in AD.
Rule of thumb
Match method to supplicant: managed Windows domain devices often use PEAP-MS-CHAPv2 or EAP-TLS; certificate-based BYOD uses EAP-TLS; guests use web auth. Always verify the server certificate chain.
Worked example
A laptop fails PEAP. Check: (1) does the client trust ClearPass's CA? (2) is the server cert valid and matching? (3) does the inner MS-CHAPv2 succeed against AD? (4) does AD return the group attribute role mapping needs? Fix the first failing layer.