Hey Daniel,
I just wanted to give you an update. I completely forgot the day off for
anzac day yesterday so I was unable to fire up the lab. However I did find
my testing notes. As i mentioned in my previous email. I couldn't get the
android google store (australia) bypass to work. I preinstalled the app and
when PF asked me to install the app I then clicked the installed app and it
asked me for the cert password and it then proceeded to install the
settings. I did get a cert warning as the CA cert wasn't trusted but I just
accepted this on the test phone and it was installed in the phones trusted
certs with the device cert. The wireless settings were also pushed
successfully.
I did have a issue with my originally setup, specifically around the
provisioning were it just wouldn't work at all (like the issue your having)
and to resolve it I had to do a fresh install of packetfence and manually
restore the settings.
For onboarding, you will just a private self-signed CA cert for the
onboarding process, this must be accepted by the user as part of the
onboarding process and it typical for NAC solutions to use self-signed
certs for EAP authentications.
I won't be back in the office until Thursday but I'm curious to see if I
have any issues with a lollipop android device as I only tested with
Jellybean. I'll get back to you with my progress.
Cheers,
Jonathan
On 20 April 2016 at 10:52, Hack, Daniel (DPIPWE) <
[email protected]> wrote:
> Thanks Jonathan, that would be great!
>
> I’ve tried your approach just now…
>
> Connect to the open SSID, authenticate to the portal, launch the agent and
> click configure.
>
> I get prompted for the certificate password (PF PKI client certificate for
> EAP), which is promising, but the agent gives ‘error: cannot create network’
>
> I can only guess that’s due to the cert being untrusted on the Android’s
> trusted root store.
>
> If you get a chance to have a look at your test lab next week, that would
> be great!
>
> Thanks,
>
> Dan
>
>
>
> *From:* Jonathan Mahady [mailto:[email protected]]
> *Sent:* Wednesday, 20 April 2016 11:18 AM
>
> *To:* [email protected]
> *Subject:* Re: [PacketFence-users] SSL server certificate for use with
> Android
>
>
>
> Hey Daniel,
>
> From memory I had to click the application once it got to that page. The
> profile and certs were then pushed (you need to accept the cert error).
> With any of the NAC solutions I've worked with the radius cert has always
> been apart of clients domain CA and PKI infrastructure. The CA cert is then
> pushed to the client which the user has to accept along with their newly
> created device cert. I have a test lab in the office, let me fire up a
> packetfence instance and test it again. I won't be in the office until
> Monday, I'll drop you an update then.
>
>
>
>
>
>
>
> On 20 April 2016 at 08:12, Hack, Daniel (DPIPWE) <
> [email protected]> wrote:
>
> Hi Jonathan,
>
>
>
> Thanks for your reply.
>
> We’ve had the same problem with getting the app downloaded to the Android
> via passthrough.
>
> If you have an Android with the app already installed, how are you getting
> the wireless profile from the provisioner onto the device?
>
> We’re seeing that even with the agent installed, when you ‘Click here to
> install your generated wireless profile’, the browser still tries to go to
> the Google app store URL?
>
> Did you edit the template to pull the profile from the PF server somehow?
>
>
>
> Thanks,
>
> Dan
>
>
>
>
>
> *From:* Jonathan Mahady [mailto:[email protected]]
> *Sent:* Wednesday, 20 April 2016 9:04 AM
> *To:* [email protected]
> *Subject:* Re: [PacketFence-users] SSL server certificate for use with
> Android
>
>
>
> Hi Daniel,
>
> When I was testing android device I had no problem with any third party
> certs I used. The only issue I had was around allow access to the google
> play store so that users could download the app.I couldn't get the
> whitelisting for google australia to work. In the end I just asked users to
> install the packetfence app before onboarding.
>
> Cheers,
>
> Jonathan
>
>
>
> On 19 April 2016 at 18:57, Louis Munro <[email protected]> wrote:
>
>
>
> In a last ditch effort to try to get Android devices working with
> PacketFence,
> we are looking at purchasing a server certificate from a trusted CA, that
> is included in Android’s trusted root store.
>
>
>
> Has anybody been down this path?
>
> Any recommendations for certificate providers?
>
>
>
> Hi Daniel,
>
> Not sure if I missed your earlier messages to the list about this, but
> Android usually works well on PacketFence.
> Can you tell us a bit more about what exactly is not working and what
> leads you to believe it's related to the certificates?
>
> As for recommendations, a certificate is a certificate.
> If it's been issued by a CA trusted by the device it should just work.
>
> I have experience with InCommon, but that is not an exclusive endorsement.
>
> Regards,
>
> --
>
> Louis Munro
> [email protected] :: www.inverse.ca
> +1.514.447.4918 x125 :: +1 (866) 353-6153 x125
> Inverse inc. :: Leaders behind SOGo (www.sogo.nu) and PacketFence (
> www.packetfence.org)
>
>
>
> ------------------------------------------------------------------------------
> Find and fix application performance issues faster with Applications
> Manager
> Applications Manager provides deep performance insights into multiple
> tiers of
> your business applications. It resolves application problems quickly and
> reduces your MTTR. Get your free trial!
> https://ad.doubleclick.net/ddm/clk/302982198;130105516;z
> _______________________________________________
> PacketFence-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/packetfence-users
>
>
>
>
> ------------------------------
>
>
> CONFIDENTIALITY NOTICE AND DISCLAIMER
> The information in this transmission may be confidential and/or protected
> by legal professional privilege, and is intended only for the person or
> persons to whom it is addressed. If you are not such a person, you are
> warned that any disclosure, copying or dissemination of the information is
> unauthorised. If you have received the transmission in error, please
> immediately contact this office by telephone, fax or email, to inform us of
> the error and to enable arrangements to be made for the destruction of the
> transmission, or its return at our cost. No liability is accepted for any
> unauthorised use of the information contained in this transmission.
>
>
>
> ------------------------------------------------------------------------------
> Find and fix application performance issues faster with Applications
> Manager
> Applications Manager provides deep performance insights into multiple
> tiers of
> your business applications. It resolves application problems quickly and
> reduces your MTTR. Get your free trial!
> https://ad.doubleclick.net/ddm/clk/302982198;130105516;z
> _______________________________________________
> PacketFence-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/packetfence-users
>
>
>
> ------------------------------
>
> CONFIDENTIALITY NOTICE AND DISCLAIMER
> The information in this transmission may be confidential and/or protected
> by legal professional privilege, and is intended only for the person or
> persons to whom it is addressed. If you are not such a person, you are
> warned that any disclosure, copying or dissemination of the information is
> unauthorised. If you have received the transmission in error, please
> immediately contact this office by telephone, fax or email, to inform us of
> the error and to enable arrangements to be made for the destruction of the
> transmission, or its return at our cost. No liability is accepted for any
> unauthorised use of the information contained in this transmission.
>
>
> ------------------------------------------------------------------------------
> Find and fix application performance issues faster with Applications
> Manager
> Applications Manager provides deep performance insights into multiple
> tiers of
> your business applications. It resolves application problems quickly and
> reduces your MTTR. Get your free trial!
> https://ad.doubleclick.net/ddm/clk/302982198;130105516;z
> _______________________________________________
> PacketFence-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/packetfence-users
>
>
------------------------------------------------------------------------------
Find and fix application performance issues faster with Applications Manager
Applications Manager provides deep performance insights into multiple tiers of
your business applications. It resolves application problems quickly and
reduces your MTTR. Get your free trial!
https://ad.doubleclick.net/ddm/clk/302982198;130105516;z
_______________________________________________
PacketFence-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/packetfence-users
