Client Less authentication with MAC?

Question

I have assigned my network printer that is using a static IP as a client less user which seems to work great. However, I am wondering about mobile devices (phones and tablets). While I understand that there is an SSO client for them, I would prefer a client less solution. 
 Why can't we use a MAC address for that? 
 If that's not possible, what are other people using? Is everybody using the SSO client? 
 Thanks, 
 Jens

lferrara · Accepted Answer

Jens, 
 the trick for mobile is to use DHCP static mapping, MAC Address to IP assignment. Once you have filled the list, you can use the "IP Assignment" to create the appropriate clientless user. 
 For example: 
 In my case I have created a static mapping for my mobile, using the mac address to 192.168.0.9, then I created a clientless user mobile with the IP 192.168.0.9. 
 A nice improvements could be to assign/bind mac addresses to clientless users. 
 Hope they will improve clientless users too!

lferrara · Answer

Jens, 
 Clientless users need username, IP addresses and email. Once you have created the clientless user, you can use it as an authenticated user (like local user, STAS users and so on). 
 What you have to do is to bind the IP address and MAC address together (DHCP static mapping) and you have done. 
 If you are using static IP, then you do not need DHCP static mapping, just create the clientless user with the static IP.

David Birdsall · Answer

JensStraten said: 
 I have assigned my network printer that is using a static IP as a client less user which seems to work great. However, I am wondering about mobile devices (phones and tablets). While I understand that there is an SSO client for them, I would prefer a client less solution. 
 Why can't we use a MAC address for that? 
 If that's not possible, what are other people using? Is everybody using the SSO client? 
 Thanks, 
 Jens 
 
 The problem with MAC addresses is that they can be cloned and changed (such as in the XG Firewall). Plus, depending on how a device connects to your network, it will have a different MAC address (one for Ethernet, once for Wi-Fi, one for Bluetooth, etc). This can change the way security is handled for that device depending on how it is connected to your network. 
 For a device like a central printer that will probably only ever be connected by ethernet, MAC addressing is a decent solution, but you need to a system or procedure to watch for cloned MAC addresses.