<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7226.0">
<TITLE>FW: Re: EAP problem</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/rtf format -->
<P><FONT SIZE=2 FACE="Courier New">Alan, Thanks for the response.</FONT>
</P>
<P><FONT SIZE=2 FACE="Courier New">></FONT> <FONT SIZE=2 FACE="Courier New">Do you mean EAP-MD5? I'm not sure what MD5-Challenge is...</FONT>
</P>
<P><FONT SIZE=2 FACE="Courier New">Yes - EAP-MD5, The windows side (supplicant) is set to MD5-Challenge</FONT>
<BR>
<BR>
<BR><FONT SIZE=2 FACE="Courier New">></FONT><FONT SIZE=2 FACE="Courier New">> I did get EAP to work when I supply the User-Password attribute in the</FONT><FONT SIZE=2 FACE="Courier New"></FONT> <FONT SIZE=2 FACE="Courier New">users file, but I would like LDAP to fetch this if it is possible.<BR>
<BR>
</FONT><FONT SIZE=2 FACE="Courier New">></FONT><FONT SIZE=2 FACE="Courier New"> If you're using LDAP, it should be doing that already.</FONT>
</P>
<P><FONT SIZE=2 FACE="Courier New">I don't think it is configured right. So far I have been using LDAP for groupmembership searches only. How do you tell LDAP to fetch User-Password attribute?</FONT></P>
<BR>
<BR>
<P><FONT SIZE=2 FACE="Courier New">></FONT><FONT SIZE=2 FACE="Courier New">> If I remove the User-Password attribute in the users file, the dubug out<BR>
</FONT><FONT SIZE=2 FACE="Courier New">></FONT><FONT SIZE=2 FACE="Courier New">> shows: User-Password is required for EAP-MD5 authenitication.<BR>
<BR>
Are you getting the User-Password attribute from LDAP? The debug<BR>
log should show this.<BR>
<BR>
</FONT><FONT SIZE=2 FACE="Courier New">></FONT><FONT SIZE=2 FACE="Courier New">> Username<BR>
</FONT><FONT SIZE=2 FACE="Courier New">></FONT><FONT SIZE=2 FACE="Courier New">> Password<BR>
</FONT><FONT SIZE=2 FACE="Courier New">></FONT><FONT SIZE=2 FACE="Courier New">> Domain<BR>
</FONT><FONT SIZE=2 FACE="Courier New">></FONT><FONT SIZE=2 FACE="Courier New">><BR>
</FONT><FONT SIZE=2 FACE="Courier New">></FONT><FONT SIZE=2 FACE="Courier New">> If you supply all three values, the debug shows:<BR>
</FONT><FONT SIZE=2 FACE="Courier New">></FONT><FONT SIZE=2 FACE="Courier New">><BR>
</FONT><FONT SIZE=2 FACE="Courier New">></FONT><FONT SIZE=2 FACE="Courier New">> Identity does not match user-name<BR>
<BR>
</FONT><FONT SIZE=2 FACE="Courier New">></FONT><FONT SIZE=2 FACE="Courier New"> You're re-writing the User-Name attribute somewhere. Again, the</FONT><FONT SIZE=2 FACE="Courier New"></FONT> <FONT SIZE=2 FACE="Courier New">debug log will show this.</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">I didn't see anything in the log. If I provide the domainname debug shows username as domain\\username, LDAP shows it as domain\username, and rlm_eap complains about Identity not matching.</FONT></P>
<BR>
<P><FONT SIZE=2 FACE="Arial">-Robert Graham</FONT>
</P>
</BODY>
</HTML>