Home Knowledge Base SecureW2 Documentation How to Set Up Passwordless WPA2-Enterprise and Tie Azure AD to Network Security

How to Set Up Passwordless WPA2-Enterprise and Tie Azure AD to Network Security

Introduction

For Wi-Fi and VPN connections, Microsoft recommends moving from MS-CHAPv2 (password-based) to certificate-based authentication, such as EAP-TLS.

EAP-TLS (certificate-based authentication) requires a Public Key Infrastructure to enroll and manage Wi-Fi certificates. That’s why our cloud PKI and RADIUS are designed to integrate easily with Microsoft Entra ID, so organizations can use their Microsoft Entra ID for WPA2-Enterprise. Below, we break down the solution into three steps:

  1. Tie your PKI Infrastructure to Azure AD.
  2. Tie your RADIUS Infrastructure to Azure AD.
  3. Tie your Device Management platform to SecureW2 cloud PKI.

Prerequisites

The following are the prerequisites for setting up WPA2-Enterprise using the Entra ID SAML application in the JoinNow Management portal:

  1. An active subscription to the Microsoft Entra portal.
  2. An active subscription to the JoinNow Management Portal and the JoinNow Cloud Connector.

Configuring Entra ID

Configuring a Microsoft Entra SAML Application for WPA2-Enterprise

End-users can enter their credentials in the SAML app, which are then sent to Microsoft Entra ID and verified. Once Microsoft Entra ID sends back attributes, the SAML app will share them with SecureW2 PKI to issue certificates.

Creating a SAML Application in Microsoft Entra

The SAML application is a crucial connection between the Core Provider and the JoinNow Management Portal. It allows a user to enter their credentials, which are then passed to the Core Provider for verification.

To create a SAML application in Microsoft Entra, perform the following steps:

  1. Log in to the Microsoft Entra admin center.
  2. From the left pane, navigate to Entra ID > Enterprise apps.
  3. Click New application.
  4. On the Browse Microsoft Entra Gallery page, type “SecureW2 JoinNow Connector” and select SecureW2 JoinNow Connector.
  5. On the SecureW2 JoinNow Connector pop-up window, enter the name of the application, and click Create.

Configuring Single-Sign-On in Microsoft Entra

To configure single sign-on in Microsoft Entra, perform the following steps:

  1. In the left pane, navigate to Manage > Single sign-on.
  2. On the Single Sign-on page, select SAML.
  3. In the Basic SAML Configuration section, click the Edit button.
  4. On the Basic SAML Configuration section, perform the following steps:
    1. In the Identifier (Entity ID) field, click Add identifier, then paste the Entity ID you copied earlier from the Creating a Core Provider section.
    2. In the Reply URL (Assertion Consumer Service URL) and Sign on URL fields, enter the ACS URL obtained in the Creating a Core Provider section.
    3. Click Save.
  5. Navigate to Attributes & Claims and click the Edit button.
  6. On the Attributes & Claims section:
    1. The Attributes & Claims page defines the claims Entra ID includes in the SAML token. Copy the emailaddress, givenname, and name claims listed under Additional claims, and map them in the JoinNow Management Portal under Attribute Mapping (step 9), ensuring JoinNow correctly reads the user information Entra ID sends in the SAML token.
  7. Scroll down to the SAML Certificates section.
    1. Click Download to save the Federation Metadata XML file from Microsoft Entra.

Integrating Entra ID with the Microsoft Entra SAML Application

After you configure your SAML application in Microsoft Entra and SecureW2, assign users to the application. You can assign users directly from Microsoft Entra or integrate the application with Active Directory. The following sections describe both methods.

Creating a Group in Microsoft Entra

To create a group in Microsoft Entra, perform the following steps:

  1. Search for Groups, and then click New group.
  2. On the New Group page:
    1. From the Group type drop-down list, select Security.
    2. In the Group name field, type a suitable name for the group.
    3. In the Group description field, type a description for the group.
    4. From the Membership type drop-down list, select Assigned.
    5. In the Members field, click No members selected.
    6. On the Add members page, search for one or more members. Select the desired member(s) from the list, and then click Select to add them to the group.
  3. Click Create.

    NOTE: Repeat steps a-c to create additional groups and add members, as required.

  4. In the left pane, navigate to All groups, and search for the group you created. Copy the Object Id to map it under Groups in the JoinNow Management Portal.

Adding Users to the SAML Application

To add users to the SAML application in Microsoft Entra, perform the following steps:

  1. In the left pane, navigate to Manage > Users and groups.
  2. Click Add user/group.
  3. On the Add Assignment page, click None Selected in the Users and groups section.
  4. On the Users and groups page, search for the user or group , and then click Select.
  5. On the Add Assignment page, click Assign.

Grant SAML Application Access to Active Directory

To allow your SAML application to access Active Directory, perform the following steps:

  1. In the Microsoft Entra portal, type “App registrations” in the search box and select App registrations.
  2. Click the All applications tab, search for the application created in the Creating a SAML Application in Microsoft Entra section, and select the application.
  3. On the displayed page, navigate to Manage > API permissions.
  4. On the API permissions screen, click Add a permission.
  5. Select Microsoft Graph.
  6. Select Delegated permissions.
  7. In the Select permissions section, select the following permissions:
    1. Directory.Read.All
    2. Group.Read.All
    3. User.Read.All
  8. Click Add Permissions to add the permissions.
  9. After adding the permissions, click Grant admin consent for {your organization} to grant consent for the requested permissions.
  10. In the Grant admin consent confirmation pop-up window, click Yes.
  11. The configured APIs are displayed on the Configured permissions page.
  12. Navigate to Manage > Manifest.
  13. Click the Microsoft Graph App Manifest (New) tab.
  14. Change the value of the groupMembershipClaims variable to “All” in the source code.
  15. Click Save.

Configuring Group Mappings for SAML in Microsoft Entra ID

To configure group mappings for SAML using Microsoft Entra ID, perform the following steps:

  1. In the left pane, navigate to Manage > Single sign-on.
  2. In the Attributes & Claims section, click the Edit button.
  3. On the Attributes & Claims page, click + Add a group claim.
  4. On the Group Claims pop-up window:
    1. Select Groups assigned to the application.
    2. From the Source attribute drop-down list, retain Group ID.
    3. Click Save.
    4. Copy the newly added group claim under Additional claims.

NOTE: If you don’t customize the Group Claim name, Microsoft Entra defaults to to http://schemas.microsoft.com/ws/2008/06/identity/claims/groups, and this value must be entered as the Group Map Attribute in the JoinNow Management Portal.

Configuring SecureW2 JoinNow Management Portal

The high-level steps to set up SAML authentication are:

  1. Creating a Core Provider
  2. Policy Management

Creating a Core Provider

To create a core platform in SecureW2:

  1. Log in to the JoinNow Management Portal.
  2. Navigate to Integration Hub > Core Platforms.
  3. Click Add.
  4. In the Name and Description fields, enter a name and a suitable description for the core provider.
  5. From the Type drop-down list, select Entra ID SAML under the Core Provider category.
  6. Click Save. The page refreshes, and the Configuration, Attribute Mapping, and Groups tabs are displayed.
  7. To map a group attribute from Entra ID to the JoinNow Management Portal, enter the value http://schemas.microsoft.com/ws/2008/06/identity/claims/groups in the Group Map Attribute field. This value comes from the Configuring Group Mappings for SAML in Microsoft Entra ID section.
  8. Click the Configuration tab.
    1. Copy the Entity ID and ACS URL values to a text editor. You’ll use these later when configuring your SAML application in Microsoft Entra.
    2. In the Core Provider Info section, click Choose file, and select the Federation Metadata XML file you downloaded earlier from Microsoft Entra, and then click Upload.
  9. Click the Attribute Mapping tab.
    1. Click Add.
    2. In the Local Attribute field, enter a name for the attribute that corresponds to the Remote Attribute. 
    3. From the Remote Attribute drop-down list, select User Defined and enter the exact claim name from Entra ID.
    4. Click Next to create the custom attribute with the appropriate mapping.
  10. Select the Groups tab.
      1. Click Add.
        1. In the Local Group field, enter a  group name.
        2. In the Remote Group field, enter the Object ID of the group from Microsoft Entra.
        3. Click Create.
  11. Click Update.

Policy Management

Certificates can be encoded with attributes to provide identity context for each network connection, enabling you to create VLAN policies for users. This section explains how to send these attributes to SecureW2 for certificate encoding and configure policies in the JoinNow Management Portal.

Creating an Authentication Policy

If you’ve already set up an authentication policy through Getting Started, you can either edit it with the required values or create a new one.

To create a new Authentication Policy, perform the following steps:

  1. Navigate to Policy Management > Authentication. 
  2. On the Authentication page, click the Edit link for your network profile’s authentication policy.
  3. Click the Conditions tab and verify that your network profile is displayed in the Profile field.
  4. Click the Settings tab.
  5. From the Core Provider drop-down list, select the core provider that you created earlier.
  6. Select the Enable User Self Service checkbox if required.
  7. Click Update.

Creating a Policy Workflow

To add a policy workflow in SecureW2, follow these steps:

  1. Navigate to Policy Management > Policy Workflows.
  2. Click Add Policy Workflow.
  3. In the Basic section, enter the name of the policy workflow in the Name field.
  4. In the Display Description field, enter a suitable description for the policy workflow.
  5. Click Save.
  6. The page refreshes, and the Conditions tab is displayed.
  7. From the Core Provider drop-down list, select the core provider you created earlier (refer to the Creating a Core Provider section).
  8. Click Update.

Creating an Enrollment Policy

To create an enrollment policy, perform the following steps:

  1. Navigate to Policy Management > Enrollment.
  2. Click Add Enrollment Policy.
  3. In the Basic section, enter the name of the enrollment policy in the Name field.
  4. In the Display Description field, enter a suitable description for the enrollment policy.
  5. Click Save.
  6. The page refreshes, and the Conditions and Settings tabs are displayed.
  7. Select the Conditions tab.
  8. In the Policy Workflow list, select the policy workflow you created earlier (see the Creating a Policy Workflow section).
  9. In the Device Role list, select DEFAULT DEVICE ROLE POLICY 1.
  10. Click Update.

Creating a Network Policy

To configure a Network Policy, perform the following steps:

  1. Navigate to Policy Management > Network.
  2. On the Network page, click Add Network Policy.
  3. Under the Basic section, in the Name field, enter the name of the network policy.
  4. In the Display Description field, enter a suitable description for the network policy.
  5. Click Save.
  6. The page refreshes, and the Conditions and Settings tabs are displayed.
  7. Select the Conditions tab.
  8. In the Conditions section, select Match All or Match Any based on your requirement to set authentication criteria. In the case explained here, we are selecting Match All.
  9. Click Add rule and select the policy workflow you want to assign to this network policy. It is essential to select the appropriate policy workflow, as it triggers the network policy. This menu offers various rules that you can select based on your business requirements.
  10. Click Save.
  11. From the Policy Workflow Equals drop-down list, select the policy workflow you created earlier. You can select multiple policy workflows to assign to a Network Policy.
  12. Click the Settings tab.
    1. From the Access drop-down list, select any one of the options to allow or deny authentication requests. The default value is “Allow”.
    2. To configure MFA, select the checkbox to enable MFA.
    3. From the Perform MFA Using drop-down list, select a Core Provider for MFA.
    4. Click Add Attribute.
      1. From the Dictionary drop-down list, select an option:
        1. Radius: IETF – This is what we will use for the following attributes, as we are using standard RADIUS attributes for VLAN assignment.
        2. Custom: Used for any VSAs (Vendor-Specific Attributes)
      2. From the Attribute drop-down list, select one of the pre-configured RADIUS attributes.
      3. In the Value field, enter a value for the RADIUS attribute.
    5. Click Save.
    6. Repeat for any other RADIUS attribute you would like to send. For reference, here is what is commonly required for VLAN Assignment:
      1. Tunnel-Medium-Type: IEE-802
      2. Tunnel-Private-Group-ID:  {VLAN Name} 
      3. Server
Tunnel-Type: VLAN
  13. Click Update.

Republish Your Network Profile

To republish your network profile:

  1. Navigate to Device Onboarding > Profiles, then select the network profile you want to publish or republish. Click Publish (or Republish if it has already been published). The process may take 60–90 seconds to complete. 
  2. After publishing successfully, click Open landing page under Functions.
  3. Click the JoinNow button. It downloads a Wi-Fi wrapper package.
  4. Open the downloaded file and enter your Microsoft Entra credentials when prompted.
  5. The device attempts to enroll and connect. Verify that the enrollment is successful.
    NOTE: If you notice any issues with your setup, please write to support@securew2.com
More Microsoft Entra ID Explainers