I am attempting to use Windows Server 2008 NPS to provide 802.1x authentication against our Cisco switches. The set-up works fine for local domain users, I am now attempting to integrate it with an external organisations Kerberos system.
I have added the relevant entries with ksetup, configured a trust with the Kerberos system and set-up a name mapping for a test user. I can now authenticate Windows desktop machines against Kerberos without any issues.
I would now like to be able to authenticate with Kerberos on the NPS machine.
On an 802.1x enabled client, using my local domain credentials allows me to access to access the network. Access is immediately denied if I use my Kerberos credentials and access is denied after a short pause if I use Kerberos credentials with the "Logon domain" set to the correct value.
With the "Logon domain" set, the NPS server logs that the authentication attempt was denied because "The domain that is specified in the User-Name attribute of the RADIUS message does not exist."
Sorry for the long ramble. I hope it makes sense to someone.