Three companies want to allow their employees to seamlessly connect to each other's wireless corporate networks while keeping one consistent wireless client configuration. Each company wants to…

A hierarchical RADIUS system enables each company to operate its own RADIUS server while using RADIUS proxy chaining to forward authentication requests to the user's home organization. When a visiting employee connects, the local RADIUS server proxies the EAP-PEAP-MSCHAPv2 authentication request to the employee's home RADIUS server, which validates the credentials against its own directory and returns the result. This preserves each company's independent authentication infrastructure, supports 802.1x natively, and requires only a single shared SSID and client configuration.

Shibboleth is a SAML 2.0 web-based identity federation system and is fundamentally incompatible with 802.1x EAP-PEAP-MSCHAPv2, which requires a RADIUS-based authentication path, not browser-based SAML assertions.

A central portal-based SSO solution relies on HTTP browser redirects for authentication and cannot integrate with 802.1x supplicant-level authentication as required by EAP-PEAP-MSCHAPv2.

Using a shared cloud wireless controller from the same vendor centralizes infrastructure management but does not provide a mechanism for each company to independently authenticate its own users via its own directory.