Quickstart: Getting started with RADNAC

Navigate to Microsoft Entra ID found at https://entra.microsoft.com/.

From there navigate from the left sidebar through Entra ID  App registrations  All applications, search for the Service Principal you created (‘RADNAC Deployment’) and select it.

In the panel that opens click on the Delete button at the top.

In the main Azure Portal, navigate to ‘Resource groups’ by typing into the search box at the top ‘resource groups’ and clicking on it.

Create a new resource group by clicking on the Create button at the top, provide the name ‘radnacmisc’ (for the purpose of this demo) then click on the Review + create button at the bottom and after reviewing, click on the Create button at the bottom.

Once the resource group has been created (you may need to click the Refresh button at the top), now either:

In the wizard, select your newly created resource group to deploy the Key Vault to, provide it a name, a region close to you and leave all other fields left at their defaults (eg. ‘Pricing tier’ at ‘Standard’, ‘Days to retain deleted vaults’ at 90 days, …​) and click on the Review + create button at the bottom.

On the ‘Review + create’ step, click on the Create button, wait for the Key Vault to be deployed and then click on the Go to resource button.

To grant access to the Key Vault for both yourself and RADNAC, you will need navigate to Access Control (IAM)  Add  Add role assignment on the left hand menu to open the add role wizard

Select Role  Job function roles  Key Vault Administrator and then in the Members menu tab, for ‘Assign access to’ select the User, group, or service principal radio button, and under the Members menu select yourself, then Review + assign at the bottom of the page

Repeat the add role wizard, though this time select Role  Job function roles  Key Vault Certificate User and then in the Members menu tab, for ‘Assign access to’ select the ‘Managed identity’ radio button, and under the Members menu select Managed identity  Managed application and choose radnacdemo, then Review + assign at the bottom of the page on, and under the Members menu select yourself, then Review + assign at the bottom of the page

Download the demo server certificate.

Navigate to the certificate importing wizards by click through the menu Objects  Certificates  Generate/Import

Select ‘Import’ from the ‘Method of Certificate Creation’ dropdown, set the ‘Certificate Name’ to ‘radnacdemocert’, upload the downloaded radnacdemocert.pfx certificate from above, leave the ‘Password’ field blank and then click on the Create button

From the web user interface, click on the Realms tab and then click on the table entry 'NULL

Check the ‘Allow EAP-TTLS’ option

From the ‘Key Vault holding Host Certificate’ dropdown select the Key Bault you created above and for ‘Name of certificate in Key Vault’ use the dropdown to select the certificate.

For the ‘Allowed Inner Methods for EAP-TTLS’ leave at its default of both ‘PAP’ and ‘EAP-GTC’ being checked

Click on the Save button at the bottom.

You will be brought back to the main Realm table listing tab where it should show for the ‘NULL’ entry the configuration as “Methods allowed EAP-TTLS[Using 'radnacdemocert' from the Key Vault '(yourkeyvault)']/{PAP,EAP-GTC}” and status as ‘EAP-TTLS: OK’ with no action being required.

Open the wireless settings page by either

After a few moments your phone should show the ‘radnacwifi’ wireless network from the list of available networks

Tap on the ‘radnacwifi’ entry

A configuration dialog will open where you should set:

Leave all other fields at their default values

Click on the Connect button at the bottom

If using Android 13, you may be prompted to confirm that you trust the network, it should show ‘radnacdemo’ and you should click on ‘Yes, connect’

You should now be connected

Open the wireless settings page by going to Settings  Wi-Fi

Tap on your new wireless network ‘radnacwifi’

You will be prompted for a username (eg. ‘bob’) and password (eg. ‘hello’), use the values for the user you created above in RADNAC

Tap on ‘Join’ in the top right

You will be presented with a dialog asking you if you trust the ‘radnacdemo’ certificate, which you should tap ‘Trust’ in the top right

You should now be connected

Open the wireless networks listing by clicking on the wireless icon in the bottom

Click on the right chevron (‘>’) to access 'Manage Wi-Fi connections'

Click on ‘radnacwifi’ and then on ‘Connect’

You will be prompted for a username (eg. ‘bob’) and password (eg. ‘hello’), use the values for the user you created above in RADNAC

Click on ‘OK’

You will be presented with a dialog asking you if you trust the network and optionally review the certificate details, click on ‘Connect’

You should now be connected