1

Say an NPS server is authenticating users of an AD through EAP-TLS.

When the client sends his certificate does the NPS server actually check to see if this certificate belongs to the user in the certificate's Subject Name or does it only check to see if the certificate is valid?

I.E.: Can the NPS server differentiate between the certificate of an Admin and the certificate of a less privileged user or do they all look the same to it?

Improve this question

1 Answer 1

Reset to default
0

NPS does authentication. So it checks:

  1. Whether the certificate is generally valid (trusted chain, revocation, policies, etc.)

  2. Whether the issuer of the certificate is eligible to issue client authentication certificates

  3. Whether subject (UPN value in the SAN extension to be more precise) matches to any entity in AD.

If all checks are passed, the certificate is mapped to an actual user account.

Improve this answer
8
  • "3. Whether subject (UPN value in the SAN extension to be more precise) matches to any entity in AD." So it only checks to see if the UPN matches with a username in AD? It doesn't actually check to see if the user owns the private key associated with that particular account?
    – Newlo Newly
    Aug 13, 2017 at 9:17
  • Connecting client must provide a possession of a private key associated with the presented certificate. It is done during EAP-TLS authentication.
    – Crypt32
    Aug 13, 2017 at 10:06
  • Not that. I meant this: Does the NPS server check to see who the certificate belongs to? Like this: The NPS server already knows the public key associated with the user in AD, so when he's authenticating it checks to see if he has the private key associated with that public key. Does the NPS server do that?
    – Newlo Newly
    Aug 13, 2017 at 15:12
  • The NPS server already knows the public key associated with the user in AD -- no, NPS does not know that, because client authentication certificates are not (usually) published in AD.
    – Crypt32
    Aug 13, 2017 at 15:14
  • So the NPS server does not know the difference between an admin certificate and a normal user certificate?
    – Newlo Newly
    Aug 13, 2017 at 16:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.