My question is more from a conceptual point of view, rather than implementation (even though I'm asking about proprietary protocols and products).
Assuming I have users and credentials set up in my Active Directory. Users can log in to their desktops using those credentials.
As far as I understand it, I can use Microsoft NPS as a RADIUS server and configure PEAP mode so that users (from a wireless device) are prompted to enter their credentials, which are transferred encrypted (using a server digital certificate) from the wireless device to the RADIUS server.
1) How are the credentials transferred from the RADIUS Server to the AD (assume different servers in different VLANS)? Or is the RADIUS just a pass-through and it is the AD that can decrypt the credentials?
2) If I want to use EAP-TLS instead (assuming a client certificate was issued for each wireless device), does the client certificate map to a user in AD? If so, where is the mapping done and how is the communication between RADIUS and AD?