Question

An administrator is deploying EAP-TLS for corporate laptops. Users present certificates where the Subject Alternative Name (SAN) contains the user's UPN, but the Subject Common Name (CN) field is blank. Authentication is failing during the identity lookup against Active Directory. What must the administrator configure so ISE extracts the correct principal name from the certificate for the AD lookup?

Accepted Answer

Create a Certificate Authentication Profile that uses the SAN attribute as the Principal Username and reference it in the Identity Source of the authentication policy

Answer

Enable Certificate Authority Chain validation on the trusted certificate store so the CN is populated automatically

Answer

Configure an Authorization Profile that maps the SAN to a downloadable ACL for the AD group

Answer

Add the client certificate template to the External RADIUS Server sequence used by the PSN