<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:st1="urn:schemas-microsoft-com:office:smarttags" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<meta name=Generator content="Microsoft Word 11 (filtered medium)">
<!--[if !mso]>
<style>
v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style>
<![endif]--><o:SmartTagType
namespaceuri="urn:schemas-microsoft-com:office:smarttags" name="PersonName"/>
<!--[if !mso]>
<style>
st1\:*{behavior:url(#default#ieooui) }
</style>
<![endif]-->
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:blue;
text-decoration:underline;}
p
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
span.E-MailFormatvorlage18
{mso-style-type:personal-reply;
font-family:Arial;
color:navy;}
@page Section1
{size:595.3pt 841.9pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.Section1
{page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=DE link=blue vlink=blue>
<div class=Section1>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>I had the same problem here and my only
solution was to turn off this check of the username. <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>of the username. <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>Ou only have to comment out the
check_cert_cn Entry at the eap.conf to deaktivate this. Butt his turn of the
check completely also for user certificates. I changed the username from „host/username“
to „username$“ which is mostly needed using the mschap Modul
aktivating „with_ntdomain_hack“ and adding „mschap: “
to the needed authentication part like ldap section or mysql section like <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>(mschap:User-Name)<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>Maybe there is an other solution to fix
that problem without deaktivate this feature?<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>Armin<o:p></o:p></span></font></p>
<div>
<div class=MsoNormal align=center style='text-align:center'><font size=3
face="Times New Roman"><span style='font-size:12.0pt'>
<hr size=2 width="100%" align=center tabindex=-1>
</span></font></div>
<p class=MsoNormal><b><font size=2 face=Tahoma><span style='font-size:10.0pt;
font-family:Tahoma;font-weight:bold'>Von:</span></font></b><font size=2
face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma'>
freeradius-users-bounces+kraemer.armin=web.de@lists.freeradius.org
[mailto:freeradius-users-bounces+kraemer.armin=web.de@lists.freeradius.org] <b><span
style='font-weight:bold'>Im Auftrag von </span></b>Carl Wahlin<br>
<b><span style='font-weight:bold'>Gesendet:</span></b> Mittwoch, 9. August 2006
17:09<br>
<b><span style='font-weight:bold'>An:</span></b> <st1:PersonName w:st="on">freeradius-users@lists.freeradius.org</st1:PersonName><br>
<b><span style='font-weight:bold'>Betreff:</span></b> EAP identity - username
check</span></font><o:p></o:p></p>
</div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='margin-bottom:12.0pt'><font size=2 face=Tahoma><span
style='font-size:10.0pt;font-family:Tahoma'>Hello,<br>
<br>
We are trying to get machine certificates to with freeradius for WLAN.<br>
<br>
Problem:<br>
We are using the sql user database plugin as we need to return attributes
(which vlan the user belongs to, QoS etc) and it all works fine untill we
install the certificates as machine certs. Windows changes the User-Name to
host/username and that causes the username not to be correct according to what
is in the database, and also the User-Name does not match the cn in the cert.
We can change the attribute with search and replace, but then EAP gives us the
error "identity does not match the User-Name, setting from EAP
Identity". <br>
<br>
Is there a way around this? It would be nice to be able to turn off the EAP
identity - User-Name check as we really do not think it is necesary in our
solution (and do not really see a security benifit of having it).<br>
<br>
Any ideas?<br>
<br>
/Carl<br>
<br>
<br>
<o:p></o:p></span></font></p>
<div class=MsoNormal align=center style='text-align:center'><font size=2
face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma'>
<hr size=2 width="100%" align=center>
</span></font></div>
<p class=MsoNormal><font size=2 face=Tahoma><span style='font-size:10.0pt;
font-family:Tahoma'>With MSN Spaces email straight to your blog. Upload jokes,
photos and more. It's free! <a
href="http://clk.atdmt.com/MSN/go/msnnksac0030000001msn/direct/01/?href=http://www.imagine-msn.com/spaces"
target="_new">It's free!</a><o:p></o:p></span></font></p>
</div>
</body>
</html>