Home Knowledge Base SecureW2 Documentation Integrating SecureW2 CloudRADIUS with Third-Party PKI

Integrating SecureW2 CloudRADIUS with Third-Party PKI

Introduction

SecureW2 CloudRADIUS is a flexible component that can be integrated with any third-party PKI. The following help guide outlines the necessary configuration steps to integrate JoinNow CloudRADIUS with PKI vendors. 

Microsoft PKI, which recently added a Cloud PKI to its Intune suite of services, is considered a third-party PKI for the purposes of this help guide. SecureW2 CloudRADIUS can seamlessly integrate with Microsoft Cloud PKI, helping customers to authenticate their certificates to connect to secure WiFi.

Prerequisites

  1. Microsoft Intune Suite license or Microsoft Cloud PKI standalone Intune add-ons license. For more information on Microsoft licensing options, visit Microsoft Intune licensing
  2. SecureW2 CloudRADIUS licensing. 

Accessing the Microsoft CloudPKI for the Certificate Authorities

Microsoft Cloud PKI includes Certificate Authorities that issue the client certificates. To enable SecureW2 CloudRADIUS to authenticate these certificates for WiFi, it is essential that the Root and Intermediate Certificate Authorities be available in the JoinNow Management portal.

The following steps describe the required Certificate Authorities to be downloaded from Microsoft CloudPKI and uploaded to the SecureW2 CloudRADIUS:

Downloading the Certificate Authorities from Intune

  1. To download the Root and Intermediate CAs from Intune, navigate to Tenant Admin > Cloud PKI. Click the created CA, then download the Root CA certificate.
  2. Download the Intermediate CA the same way.

Configuring Azure

This section describes the steps to configure Azure and Intune for lookup operations during Wi-Fi authentication.

Creating a New Application

To create an app in Azure to communicate with the CA Intune IdP,  follow the given steps:

  1. Log in to the Azure portal.
  2. Go to App registrations.
  3. Click New registration.
  4. On the Register an application page, enter the name of the application in the Name field.
  5. In the Supported account types section, specify who can use the application by selecting any one of the following options:
    1. Accounts in this organizational directory only (MSFT only – Single tenant)
    2. Accounts in any organizational directory (Any Microsoft Entra ID tenant – Multitenant)
    3. Accounts in any organizational directory (Any Microsoft Entra ID tenant – Multitenant) and personal Microsoft accounts (e.g., Skype, Xbox)
    4. Personal Microsoft accounts only
  6. Click Register. The following screen is displayed.
  7. Copy the Application (client) ID, Object ID, and Directory (tenant) ID values to your console. These values are required to create an Intune IdP in the JoinNow Management Portal (refer to the 5.2 Creating a Core Provider section).

Creating a Client Secret

  1. On the left pane, go to Manage and click Certificates & secrets.
  2. Click New client secret.
  3. In the Add a client secret pop-up window, enter a description for the client secret in the Description field.
  4. From the Expires drop-down list, select the expiration date of the client secret.
  5. Click Add.
  6. The client’s secret is displayed under the Value column. Copy the client secret and expiration date to a text editor.

NOTE: Ensure that you properly save the client secret in your console, as this secret is non-recoverable.

Adding API Permissions

The following API permissions should be selected for a successful Lookup operation. These permissions allow the MDM to read group and user attributes to validate RADIUS authentication. 

  1. Navigate to API Permissions under the Manage section.
  2. Click Add a permission and add the following permissions:
  3. After adding the permissions, click Grant admin consent for {your organization}.

Configuring Intune

Creating Trusted Certificate Profiles in Intune

The downloaded CA certificates must be uploaded to the corresponding trusted profiles before being deployed on client devices. The deployment of these CA certificates is necessary to form a chain of trust during the enrollment and RADIUS authentication. Intune requires the creation of three trusted certificate profiles:

  1. Trusted Certificate Profile for Root CA
  2. Trusted Certificate Profile for Intermediate CA 
  3. Trusted Certificate Profile for Root CA of the RADIUS Server certificate

To create trusted profiles in Intune:

  1. Sign in to the Microsoft Endpoint Manager portal.
  2. Navigate to Devices > Configuration > Create > New Policy.
  3. On the Create a profile page, select the device platform from the Platform drop-down list for this trusted certificate. The options are:
    1. Android
    2. iOS
    3. macOS
    4. Windows 10 and later
      NOTE: You must create a separate profile for each OS platform. The steps to create trusted certificates are similar across device platforms. 
  4. From the Profile type drop-down list, select Templates, and then select Trusted certificate.
  5. Click Create.
  6. On the Trusted certificate page, in the Basics section, enter a suitable name for the Trusted Certificate in the Name field. Suitable naming conventions, such as “Root, Intermediate, and RADIUS CA,” can be used for easy identification.
  7. In the Description field, enter a suitable description for the trusted certificate.
  8. Click Next.
  9. In the Configuration settings section, click the Browse button for the Certificate file field. Select the certificate appropriate to the trusted profile being created, as shown in the table below:
    Trusted Profile mapped with Intermediate CATrusted Profile mapped with Root CATrusted Profile mapped with RADIUS Server Root CA

    Upload the Intermediate CA downloaded from Microsoft cloud PKI in 2.1 Creating an Intermediate (Issuing) CA

    From the Destination store drop-down, select  “Computer certificate store – Intermediate”.

    Upload the Root CA of the organization downloaded from Microsoft Cloud PKI in 2.1 Creating Root CA in Microsoft Cloud PKI

    From the Destination store drop-down, select  “Computer certificate store – Root”

    Upload the RADIUS Server Root CA of the organization downloaded from the JoinNow portal in 5.1 Downloading the RADIUS Server Root CA

    From the Destination store drop-down, select  “Computer certificate store – Root”

  10. Click Next.
  11. Assign the profile to the appropriate Groups and Rules, review it, and click Create.

Wi-Fi Profile for Secure SSID Configuration

Microsoft Intune includes built-in Wi-Fi settings that you can deploy to users and devices in your organization. This group of settings is called a profile, which can be assigned to different users and groups. Once you assign users a profile, they can obtain access to the network without configuring it themselves.

Creating a Wi-Fi Profile

  1. Sign in to the Microsoft Endpoint Manager portal.
  2. Navigate to Devices > Configuration > Create > New Policy.
  3. On the Create a profile page, select the device platform from the Platform drop-down list for this trusted certificate.

    NOTE: You must create a separate profile for each OS platform. The steps to create trusted certificates are similar across device platforms. 
  4. From the Profile type drop-down list, select Templates, and then select Wi-Fi.
  5. Click Create.
  6. On the Wi-Fi page, in the Basics section, enter the name of the Wi-Fi in the Name field.
  7. In the Description field, enter a suitable description for the Wi-Fi.
  8. Click Next.
  9. In the Configuration Settings tab, select Enterprise from the Wi-Fi type drop-down.
  10. In the Wi-Fi name field, enter the name of the broadcasting SSID.
  11. From the EAP type drop-down list, select EAP-TLS.
  12. In the Server Trust field, enter one or more common names used on your RADIUS server certificates issued by your trusted CA. For the SecureW2 RADIUS, it’s: radius01.securew2.com
  13. From the Root certificate for server validation drop-down list, select the RADIUS server certificate profile created in 4.1 Creating Trusted Certificate Profiles in Intune section. This certificate is presented to the server when the client connects to the network and is used to authenticate the connection. Select OK to save your changes.
  14. Configure the remaining required Wi-Fi settings, then click Next.
  15. Assign the profile to the appropriate Groups and Rules, review it, and click Create.
Assign a Device Profile

After creating a profile, you must specify the devices to which it will be pushed. To assign the devices, perform the following steps:

  1. Sign in to the Microsoft Endpoint Manager portal.
  2. Navigate to Devices > Configuration profiles.
  3. Select the profile you want to assign a policy to users or groups.
  4. Scroll to the Assignments section and click the Edit link.
  5. Under the Included groups or Excluded groups section, click Add groups to add one or more Entra ID Groups. To apply the policy to all relevant devices, select Add all users or Add all devices.
    NOTE: If you click Add all users or Add all devices, the Add groups option is disabled.
  6. On the Select groups to include page, select the Entra ID group to which the policy must be assigned and click Select to add the group.
  7. Click the Review + Save button.
  8. Click Save.

Configuring JoinNow

Downloading the RADIUS Server Root CA

The RADIUS server certificate is required for RADIUS authentication and subsequent access to secure Wi-Fi networks. To download the RADIUS server CA from the JoinNow Management Portal:

  1. Log in to the JoinNow Management Portal.
  2. Navigate to Device Onboarding > Profiles.
  3. Click the Edit link of the network profile configured earlier.
  4. In the Certificates section, click Add/Remove Certificate.
  5. Check the checkbox next to DigiCert Global Root G3 (Fri Jan 15 12:00:00 UTC 2038) as shown in the following screen.
  6. Click Update.
  7. The CA appears in the Certificates section.
  8. Click Download.

Creating a Core Platform to Integrate with Microsoft Entra ID

SecureW2 CloudRADIUS has been engineered to check whether a user/device is still active in Intune and to retrieve any attribute value at the time of network connection. This is important as Microsoft Cloud PKI uses just a basic SCEP, a static URL that hackers can easily abuse to issue certificates from the same trusted CA. Configuring a lookup will prove the authenticity of a user/device during every connection attempt. This will also be useful during VLAN authorization and, hence, network policy assignment.

  1. Navigate to Integrations Hub > Core Platforms.
  2. Click Add.
  3. For the Name field, enter the name of the identity lookup provider.
  4. For the Description field, enter a suitable description for the identity lookup provider.
  5. From the Type drop-down list, select Entra ID.
  6. Click Save.
  7. The page refreshes and displays the Configuration, Attribute Mapping, and Groups tabs. 
  8. Click the Configuration tab.
    1. From the Access Token Grant Flow drop-down list, select one of the following options.
      1. Client Credentials – This option eliminates the need for frequent token reauthorization from the Azure portal and is the recommended method.
      2. Authorization Code – This option requires reauthorization of the token from the Azure portal every 90 days. 
    2. In the Provider URL field, enter the URL you created earlier using the Directory (tenant) ID: https://login.microsoftonline.com/{Directory (tenant) ID}. This should look like this:
      https://login.microsoftonline.com/561bc66f-1d86-4244-8bc4-5eb12cba45ac
    3. In the Client Id field, enter the Application (client) ID that you retrieved from Azure Portal earlier (refer to the 3.1 Creating a New Application section).
    4. In the Client Secret field, enter the Client secret you generated in the Azure Portal earlier (refer to the  3.2 Creating a Client Secret section).
    5. In the Client Secret Expiry field, enter the client secret’s expiry date (refer to the  3.2 Creating a Client Secret section).
    6. Under the Lookup Configuration section, from the Device Lookup via drop-down list, select the required device lookup attribute from the options listed below:
      1. Entra ID Device ID – The lookup is performed using Azure ADID. 
      2. Entra ID Device Name – The lookup is performed using the device name. For additional search filters, select the required checkboxes: 
        1. Is Managed – checks if the device is managed. 
        2. Is Compliant – checks if the device is compliant.
    7. Click Update.

Upload the Microsoft Root and Intermediate CAs in the JoinNow Management Portal

This step is required for SecureW2 CloudRADIUS to create a chain of trust and verify the Microsoft-issued client certificate.

  1. Navigate to Dynamic PKI > Certificate Authorities and click Import Certificate Authority.
  2. In the Basic section, from the Type drop-down list, select the type of authentication as Certificate 
  3. From the Import CA for drop-down list, select ‘Device and User Authentication’
  4. In the Certificate option, upload the Root CA that you downloaded from Intune.
  5. Under the Client Certificate Validation tab, enable the Use CRL check-box.
  6. In the CRL Distribution URL field, enter the URL from where the CRL file can be downloaded to check the client certificate status.
  7. For the Update field, enter a period for CRL updation (In minutes) based on:
    1. Upon CRL Expiration – CRL file is updated after it expires.
    2. Periodically Every – CRL file is updated periodically for the selected time interval (minutes). The minimum time interval is 10 minutes.
  8. Repeat the same process for the second time for Intermediate CA. You have Now Imported both the Root and Intermediate CA from Microsoft Cloud PKI into your JoinNow Management Portal.

Configuring Policies

Configuring a Security Signal Source

Lookup Policies are how we configure the new Identity Lookup Provider to trigger based on the user or certificate values.

  1. Navigate to Policy Management > Security Signal Sources.
  2. Click Add Security Signal Source.
  3. On the displayed screen, enter a Name and Display Description for the Security signal source.
  4. Lookup Purpose – Purpose of Account Lookup
    1. Certificate Issuance – To lookup user/device account during Enrollment.
    2. RADIUS Authentication – To lookup user/device account during RADIUS Authentication.
  5. Click Save. The Conditions and Settings tabs appear.
  6. Click the Conditions tab.
  7. From the Identity drop-down list, select the required identity attribute for lookup.
  8. In the Regex field, enter the value you want to match.
  9. Under the Settings tab, from the Provider drop-down list, select the Google Workspace Identity Lookup you created in the 5.2 Creating a Core Provider section.
  10. From the Lookup Type drop-down, select:
    1. Auto – The system automatically uses identity as the Lookup attribute.
    2. Device – The Identity drop-down list is displayed. Select a device identity required for lookup.
    3. User – The Identity drop-down list is displayed. Select a user identity required for lookup.
  11. From the Identity drop-down, select the Identity attribute mapped for lookup.
  12. Click on Validate Configuration. Enter the Identity of the user/device in Enter a valid identity field. Click Validate.
  13. Click Update.

Configuring a Policy Workflow

To configure a Policy Engine Workflow:

  1. Navigate to Policy Management > Policy Workflows.
  2. Click Add Policy Workflow.
  3. In the Basic section, enter the name of the role policy in the Name field.
  4. In the Display Description field, enter a suitable description for the role policy.
  5. Click Save.
  6. The page refreshes, and the Conditions tab is displayed.
  7. Select the Conditions tab.
  8. In the Conditions section, from the Core Provider drop-down list, select the Intune CA IDP you created earlier (see the 5.2 Creating a Core Provider section).
  9. Click Update.

Configuring Network

Similar to the check during certificate issuance, Lookup can be used before the RADIUS Authentication as a dynamic check. To trigger the lookup during the RADIUS Authentication, map the policy engine workflow created in section 5.4.2, Configuring a Policy Engine Workflow in the Network Policy, created below:

  1. Navigate to Policy Management > Network.
  2. On the Network Policies page, click Add Network Policy.
  3. On the displayed screen, enter a Name and Displayed Description for the network policy in the corresponding fields.
  4. Click Save.
  5. Click the Conditions tab.
  6. Click Add rule and select the user role you want to assign to this network policy.

    NOTE: You can assign a network policy to multiple user roles.
  7. Click the Settings tab.
  8. Click Add Attribute.
    1. From the Dictionary drop-down-list, select an option: Radius:IETF or Custom.
    2. From the Attribute drop-down-list, select an option.
    3. In the Value field, enter the appropriate value for the attribute.
    4. Click Save.
    5. Click Update.

Configuring Network Controller

Setting up the Network Controller to use SecureW2 CloudRADIUS for authentication

Configure the SecureW2 CloudRADIUS IP address and shared secret into your wireless controller. Configuring the Aruba Controller is shown as an example. 

  1. Log in to the JoinNow Management Portal.
  2. Navigate to  RADIUS > RADIUS Configuration. Copy your IP address and port numbers of your RADIUS, and then configure them on your Wi-Fi controller.
  3. The Secure SSID must then be configured with the RADIUS IP details to set up a secure network for RADIUS Authentication.
    Aruba Controller set-up

After successful configuration, device authentication is tracked in RADIUS Events. To access the RADIUS Events page, log in to the JoinNow Management Portal and navigate to Data and Monitoring > RADIUS Events.

SecureW2 CloudRADIUS is flexible and can be integrated smoothly with Microsoft PKI or any other PKI Vendor. If you are stuck somewhere and need support, contact us at Support@securew2.com.

More SecureW2 Documentation Explainers