RADIIUS, TACACS+, Kerberos

What components does enterprise authentication use?

an AAA server and network directory

What is one way of implementing the AAA server when configuring enterprise authentication?

Remote Authentication Dial-in User Service (RADIUS)

How is the wireless access point configured when using RADIUS?

as a client of the RADIUS server

What does the wireless access point do with user credentials in a RADIUS setup?

forwards this data between the RADIUS server and the supplicant without being able to read it

What must the wireless access point be configured with for RADIUS?

the host name or IP address of the RADIUS server and a shared secret

What does the shared secret allow in a RADIUS configuration?

the RADIUS server and access point to trust one another

What is another way of implementing AAA besides RADIUS?

TACACS+

Who developed TACACS+?

Cisco

What is TACACS+ often used to authenticate?

administrative access to routers, switches, and access points

What is RADIUS often used to authenticate?

connections by wireless and VPN users

What protocol could in theory allow an access point to let a user authenticate directly to a directory server?

Kerberos

On Windows networks, what does Kerberos allow a user account to authenticate to?

a domain controller (DC) over a trusted local cabled segment

What does Kerberos facilitate?

single sign-on (SSO)

What does the Kerberos server issue besides authenticating the user on the network?

authorization tickets that give the user account rights and permissions on compatible application servers

In practice, what direct support do access points have for Kerberos?

there are no access points with direct support for Kerberos

What do access points use instead of direct Kerberos support?

RADIUS or TACACS+ and EAP to tunnel the credentials and tokens

What do tunneled credentials and tokens allow a domain user connecting via a wireless client to do?

authenticate to a DC and use SSO authorizations