Home Knowledge Base SecureW2 Documentation How to Use SAML for WPA2-Enterprise Authentication

How to Use SAML for WPA2-Enterprise Authentication

Introduction

Organizations worldwide trust the WPA2-Enterprise standard to strengthen their Wi-Fi network security. Together, this standard and the 802.1X protocol make sure that each user has a unique set of credentials or a specialized certificate to access wireless networks. To further secure your network, you can tie network access to policies and information from your Core Provider, which is exactly what SAML is designed to do.

SAML is the foundation of single sign-on (SSO) identity and is the protocol used by many cloud Core Providers today to communicate with other systems. In an 802.1X network using certificate-based EAP-TLS for authentication, SAML provides a means to interface with the Core Provider during the certificate enrollment phase for BYODs and to confirm user identities. All these standards and protocols come together to build the foundation for a significantly more secure WPA2-Enterprise network.

This article focuses on real-world implementation rather than marketing. It explains the key concepts behind SAML and WPA2-Enterprise and shows how they work together in practice. By the end, you’ll understand both the theory and how to implement it. Follow the step-by-step guide to configure SAML for WPA2-Enterprise authentication.

Configuring Core Provider, SAML Application, Attribute Mapping, and Policies in SecureW2

  1. Create a Core Provider in SecureW2:
    1. A Core Provider must connect to the database and verify network users.
    2. The SecureW2 JoinNow Management Portal allows the admin to enter key information about the Core Provider.
    3. After entering the Core Provider information, the SAML information must be entered into the portal.
  2. Create a SAML Application in the SAML Provider’s Console:
    1. The SAML application serves as the medium through which end users enter their credentials, are verified by the Core Provider, and initiate the certificate enrollment process.
    2. Create the SAML application by creating a custom app, then download the Core Provider metadata.
    3. The metadata can be uploaded to the SecureW2 JoinNow management Portal, and an ACS URL and EntityID will be created and copied into the custom app.
  3. Configure Attribute Mapping:
    1. Attribute mapping allows admins to categorize end users by the level of access granted.
    2. These attributes can be added and adjusted on the custom app and encoded onto the certificates:
      1. SecureW2 can encode the attributes onto certificates in the management portal.
  4. Configure Policies in SecureW2:
    1. Two policies need to be configured:
      1. Authentication – how the end user is authenticated.
      2. Policy Workflow – the access that is granted to the end user.
    2. Both of these policies can be configured in the JoinNow Management Portal.
 

Creating a SAML Application for WPA2-Enterprise Authentication

SecureW2 Device Onboarding Solution works with any Core Provider to securely authenticate users and configure their devices to access their organization’s WPA2-Enterprise Wi-Fi network.

The SAML application serves as the interface. When a user enters their credentials in the SecureW2 application to configure their device for Wi-Fi, SecureW2 uses the SAML Protocol to communicate with the Core Provider. Now SecureW2 can verify whether a user’s credentials are valid and authenticate them for a secure Wi-Fi connection.

NOTE: Make sure that your SecureW2 account with a Cloud Connector subscription is active.

To configure SAML authentication with major SAML providers and SecureW2:

  1. Create a Core Provider in SecureW2
  2. Create a SAML Application in the SAML Provider’s Console
  3. Configure Attribute Mapping
  4. Configure Policies in SecureW2

Create a SAML Core Provider in SecureW2

Creating a Core Provider within SecureW2 is your first step toward establishing a seamless link between our platform and your core provider’s user database. This critical stage not only verifies user credentials but also issues digital certificates, which help build trust and security in your authentication procedures.

A core provider is the system that verifies a user/device. Creating a core provider in SecureW2 tells the Cloud Connector system how to connect to your provider’s user database, verify user credentials, and issue digital certificates. To create a core provider in SecureW2:

  1. Log in to the JoinNow Management Portal.
  2. Navigate to Integration Hub > Core Platforms.
  3. Click Add.
  4. In the Name and Description fields, enter a name and description for the core provider.
  5. From the Type drop-down list, select SAML(Multi-Vendor).
  6. From the SAML Vendor drop-down list, select a vendor.
  7. Click Save.

Now, SecureW2 Cloud Connector knows how to exchange information with your provider’s user database.

Create a SAML Application in SAML Provider’s Console

Your SAML application is a crucial connection between your Core Provider and SecureW2. Your SAML application lets a user enter their credentials, which your core provider then verifies. Your core provider verifies the user’s identity and then sends attributes to your SAML application, which then passes the attributes to SecureW2 for certificate issuance.

SAML plays a key role in certificate enrollment for BYODs; the user enters their credentials with your core provider before being issued a certificate, and SAML helps verify their identity in your database.

As an example, here’s how to create a SAML application in Google:

  1. In your Google Admin Console, click Apps, then SAML apps.
  2. At the bottom-right of the screen, hover over the yellow circle, then click Enable SSO for a SAML Application.
  3. Click SETUP MY OWN CUSTOM APP.
  4. Under Option 2, click DOWNLOAD for Core Provider metadata. Save the metadata file (.XML) to your computer.
  5. From your SecureW2 JoinNow Management Portal, go to Integration Hub > Core Platforms.
  6. Click Edit for the previously created core provider (GoogleSAML).
  7. Click the Configuration tab.
  8. In the Core Provider Info section, click Choose File, select the metadata file, and click Upload.
  9. Copy the ACS URL and Entity ID values and paste them into a text editor.
  10. Click Update.
  11. Return to your Google SAML App setup.
  12. On the Basic information for your Custom App page, enter the Application Name and Description.
  13. Click Next.
  14. On the Service Provider Details page, paste the ACS URL and the Entity ID.
  15. Check the Signed Response box, then click Next.
  16. On the Attribute Mapping page, click Finish.

Configure Attribute Mapping

Attribute mapping defines the attributes returned by your core provider and used to grant users access to an 802.1X network. 

Using a SAML app and the Core Provider by University ABC in the example below demonstrates how attribute mapping can distinguish between student and faculty users, granting them access to the relevant areas of the course assignment portal. Attribute mapping links the user’s identity, responsibilities, and the services they may access, guaranteeing a personalized and secure user experience.

Once your core provider identifies a user, it sends the user’s attributes to your SAML application, which then forwards them to SecureW2. SecureW2 encodes these attributes onto the certificate it issues. Attributes contain information about the user and the wireless networks they can access.

Here’s an example:

University ABC employs a SAML app, a landing page where student and faculty users can enter their credentials to sign in to the course assignment portal.

The university also employs a core provider. When authenticating users, the X attribute indicates whether the user is a student or a faculty member. Student users get access to view the course assignment portal, while faculty users get access to manage assignments on the course assignment portal.

When John Doe, a university student, enters his credentials on the landing page, the core provider returns the X_student attribute. This attribute is encoded on the certificate that SecureW2 assigns to John during enrollment, granting him access to the course assignment portal.

When Dana Smith, a professor at the university, enters her credentials into the landing page, the core provider returns the X_faculty attribute. This attribute is encoded onto the certificate that SecureW2 assigns to Dana, granting her access to manage assignments on the course assignment portal. To set up SAML authentication, you need to configure attribute mapping in your SAML provider’s console, as well as in SecureW2.

Configure Attribute Mapping in Your SAML Provider

Attribute mapping in your SAML provider is vital in enabling the smooth exchange of user attributes between your identity provider and SecureW2. This procedure ensures that critical user information is delivered safely and accurately, enabling SecureW2 to incorporate these features into its EAP-TLS authentication certificates.

To map attributes in your SAML provider (we’ll use Google as an example):

  1. From your Google Admin Console, scroll to Attribute Mapping and click ADD NEW MAPPING. This allows you to configure the attributes that will be encoded onto the certificate.
  2. For Enter the application attribute, enter ‘name’.
  3. Click the Select category dropdown and select Basic Information.
  4. Click the Select user field dropdown and select First Name.
  5. Click Save.
  6. Click ADD NEW MAPPING.
  7. For Enter the application attribute, enter ‘email’.
  8. Click the Select category dropdown and select Basic Information.
  9. Click the Select user field dropdown and select Primary Email.

  10. Click SAVE.

Configure Attribute Mapping in SecureW2

Now, set SecureW2 to receive attributes from your Core Provider and securely encode them into certificates for policy usage. This configuration allows you to create user or device certificates with customized features suited to your needs for 802.1X network authentication and more. Follow these steps to map the attributes SecureW2 receives from your core provider and to update the certificate template to use them.

Now you need to configure SecureW2 to receive the attributes sent by your core provider so they can be encoded on the certificate and used for policies. These steps show you how to map the attributes SecureW2 receives from your core provider and how to edit the certificate template to use them.

  1. Log in to the JoinNow Management Portal. 
  2. Navigate to Integration Hub > Core Platforms.
  3. Click Edit for the previously created core provider (Google SAML).
  4. Select the Attribute Mapping tab.
  5. Click Add.
  6. For Local Attribute, enter email as the name of the variable.
  7. From the Remote Attribute drop-down list, select User Defined. Enter email in the field that appears, and then click Next.
  8. Click Add.
  9. For Local Attribute, enter displayName as the name of the variable.
  10. From the Remote Attribute drop-down list, select User Defined. Enter Name in the field that appears, and then click Next.
  11. Click Update.

Now that you’ve configured SecureW2 to receive the attributes, you need to ensure the attributes are encoded on the certificates issued to users. Here’s how:

  1. From your JoinNow Management Portal, go to Dynamic PKI > Certificate Authorities.
  2. Scroll down to the Certificate Template.
  3. In Certificate Template, click Edit for DEFAULT CERTIFICATE TEMPLATE 1.
  4. Retain the default values and then click Update.
  5. Click Update.

The certificate template now includes the attributes, and they will be used when certificates are issued.

Configure Policies in SecureW2

SecureW2 issues digital certificates based on the policy configuration you set up in the JoinNow Management Portal. You need to configure two policies: the Authentication and the Policy Workflows.

To configure policies in SecureW2:

  1. From your JoinNow Management Portal, go to Device Onboarding > Getting Started.
  2. On the Quickstart Profile generator page, from the Generate Profile for drop-down list, select Internal User Authentication.
  3. Click the Profile Type dropdown and select Wireless.
  4. For the SSID field, define the SSID name.
  5. Click the Security Type dropdown and select WPA2-Enterprise.
  6. Click the EAP Method dropdown and select EAP-TLS.
  7. From the Policy drop-down list, retain DEFAULT.
  8. From the Wireless Vendor drop-down list, choose a vendor.
  9. From the RADIUS Vendor drop-down list, choose a vendor.
  10. Click Create. It takes 60-90 seconds to complete the process.
  11. Navigate to Policy Management > Authentication.
  12. Click Edit for the authentication policy created during network profile creation.
  13. Select the Conditions tab, then ensure the previously created network profile is selected.
  14. Click the Settings tab.
  15. From the Core Provider drop-down list, select the previously created core provider (Google SAML).
  16. Click Update.
  17. Navigate to Policy Management > Policy Workflows.
  18. Click Edit on the DEFAULT POLICY WORKFLOW 1.
  19. Select the Conditions tab. 
  20. From the Core Provider drop-down list, select the Core Provider you created earlier (Google SAML).
  21. Click Update.

Easily Leverage SAML for Enhanced WPA2-Enterprise Authentication with SecureW2

This guide outlines the steps you need to take to leverage the power of SAML and SecureW2 advanced solutions to make WPA2-Enterprise Authentication more secure with EAP-TLS and accessible to organizations of all sizes. With this setup in place, organizations enjoy an identity-rich context for each user and network connectivity, thanks to certificate-driven security and a RADIUS server for authentication.

SecureW2 is at the center of this setup. Major SAML-based Identity Providers such as Azure AD, Google, and Okta integrate well with our Public Key Infrastructure and RADIUS. This integration makes it easy for businesses to apply their existing Core Provider rules to Wi-Fi networks, giving them greater control over who can access them. Also, our certificate-based authentication makes WPA2-Enterprise networks even more secure by replacing passwords with individualized certificates. With our easy-to-use onboarding tools, such as JoinNow MultiOS, and our managed device gateways, getting Wi-Fi login certificates for all user devices is straightforward.

Unlock the full potential of SecureW2 and enjoy enhanced safety, speed, and user satisfaction. Contact us today for a free demo.

More General Help Explainers
Reseller or MSP? Join our Partner Program