Per-user network authentication without mac-filtering

Question

I am aware of MAC address filtering available on most wifi access points, but mac filtering doesn't establish a user identity, it only controls access on a device by device basis. One user may have many devices, so mac filtering doesn't scale well. Is there any way to control network access on per-user basis?

What authentication scheme should be used to control network access where each user has their own password, and access to the network can be revoked across all their devices by revoking their login credentials?

Answer 1

I am aware of MAC address filtering available on most WiFi routers, but this is about access control on a device by device basis. One user may have many devices. Is there any way to control WiFi network access on a user by user basis?

Use 802.1X with PEAP/MSCHAPv2. This authentication scheme will permit you to authenticate your users against a RADIUS server which utilizes a central credential store, such as a local source (text file or database), MS ActiveDirectory, or LDAP.

In principle, you could also use other 802.1X authentication methods, such as EAP-TLS; however, your question implies a desire for easy management, and EAP-TLS requires per-user TLS certificates installed on each client. Managing individual TLS certificates is more maintenance than something like PEAP.