Configure Google LDAP Authentication for Wireless Networks Access
Last updated
Last updated
To set up Google LDAP authentication for EnGenius Cloud AP includes the following steps:
Setup Google LDAP server in Google Workspace and generate a certificate used for the AP and Google Workspace authentication process.
Configure Google LDAP authentication for SSID profile configuration with WPA2/ WPA3-Enterprise or Captive Portal.
Configure Google LDAP profile in client devices.
The following sections describe the detailed instructions for each step.
The user needs to apply a Google Account (Gmail) and apply Google Workspace with one of the following editions to set up an LDAP server.Business Plus, Enterprise, Education Fundamentals, Education Standard, Teaching and Learning Upgrade, and Education Plus.
To get started:
Sign in to the Google Admin console (https://admin.google.com ) as an Administrator
Add LDAP clients
Go to Apps > LDAP
Click Add Client filed
Type a name in the LDAP client name, for example: EnGenius AP
Click the Continue button
Configure Access Permission for verifying user credentials
To specify which organization units and groups EnGenius AP can access to verify the user’s credentials. Choose “Entire domain” if no specific Organization/Group is required (Note: Any change of the setting will take effect up to 24 hours)
Refer to https://support.google.com/a/answer/9058751
Generate a new certificate (used between AP and Google Workspace)
Go to Apps > LDAP
Client in the list
Click Authentication Card
Click GENERATE NEW CERTIFICATE
Click Download to save the Certificate file on the computer
Click Record the Username and Password to store credentials somewhere
Create a Firewall rule which is needed for AP to query Google Secure LDAP.
TCP and traffic direction are outgoing to port 636 of a hostname ldap.google.com
EnGenius Cloud AP can configure Google LDAP Server for WPA2/ WPA3-Enterprise or Captive Portal as an authentication server.
Login to EnGenius Cloud ( https://cloud.engenius.ai ) and click the (hamxxxx) icon to select the Network for configuration.
Go to Configure > SSID and select a specific SSID name from the list.
From the Wireless tab, select WPA2 Enterprise for Security Type.
Select Google LDAP for user authentication.
Enter configurations for the Google LDAP Server:
Enter the Administrator’s credential (Account and Password) of the Google LDAP Server
Base DN (Optional): The start point of the LDAP directory tree while AP requests to search the corresponding user’s credentials in the LDAP server. If the field is empty, AP will auto-detect the configuration from the Google LDAP Server. Otherwise, users can set the specified Base DN string according to the Google LDAP account. (Format: ‘dc=xxx,dc=ooo’)
Upload the Google Certificate zip file generated while setting up Google LDAP Server.
Import Authenticator Certificate (Optional) for customized content and Domain. (Note: The certificate is used between Access Point and wireless client devices, like 802.1x with Radius Server.)
Click the Apply button to save SSID configurations.
Go to Configure > SSID and select a specific SSID name from the list.
From the Wireless tab, select Open for Security Type.
From the Captive Portal tab, select Google LDAP for user authentication.
Enter configurations for the Google LDAP Server:
Enter the Administrator’s credential (Account and Password) of the Google LDAP Server.
Base DN (Optional): The start point of the LDAP directory tree while AP requests to search the corresponding user’s credentials in the LDAP server. If the field is empty, AP will auto-detect the configuration from the Google LDAP Server. Otherwise, users can set the specified Base DN string according to the Google LDAP account. (Format: ‘dc=xxx,dc=ooo’)
Upload the Google Certificate zip file generated while setting up Google LDAP Server.
Import Authenticator Certificate (Optional) for customized content and Domain.
Click the Apply button to save SSID configurations.
Setup LDAP Profile on Client Devices Some types of client devices (e.g., Andriod Phones) may require installing a Client (CA) Certificate (ca.pem) before getting authenticated with Google LDAP Server.
Note: The CA Certificate for LDAP Clients can be Exported via EnGenius Cloud GUI.
The LDAP client device scans out EnGenius Wifi SSID and connects it
802.1x page pops up and requests to enter Username and Password, e.g., account@example.edu.
If the Certificate page pops up, click the Trust button
For Android Phones, it is required to specify the EAP method and Phase 2 authentication. Please refer to the following settings
Enter configurations for the Google LDAP Server:
EAP method: Select EAP-TTLS.
EAP Phase 2 authentication: Select PAP (Note: if PAP is not supported on client devices, GTC is a choice but may have some compatible issues on specific devices, e.g., Chromebook)
Domain (Optional): Enter the corresponding domain shown on EnGenius Cloud GUI, e.g., engenius.ai (by default)
Choose Do not validate with CA certificate. (Google Nexus does not have this option, the certificate (ca.pem) must be installed)
