<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 11 (filtered medium)">
<style>
<!--
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:Arial;
color:windowtext;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.25in 1.0in 1.25in;}
div.Section1
{page:Section1;}
-->
</style>
</head>
<body lang=EN-US link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>I realize that this issue has been brought up many times in the past. However,
I believe I have new information that I haven’t seen reported before..
<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>I’m having a problem with Windows XP supplicant authenticating to
FR with PEAP/MSCHAPv2 where authentication fails “sometimes” depending
upon various factors. The same device I’m using to test wireless
authentication, never has an issue authenticating to my old dain-bramaged Cisco
ACS servers. As a result, I decided to investigate what might be different
about FreeRadius (perhaps Samba I thought, but didn’t want to make
assumptions). <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>I don’t profess to be an MS-CHAP expert, so what I’m about
to say may be completely off-base.. After performing many tests (see below) and
reviewing RFC2579 and the code in rlm_mschap.c, I’m hypothesizing that the
problem is with how rlm_mschap calculates the challenge hash that is passed to
ntlm_auth. Specifically, rlm_mschap uses the User-Name attribute as part
of the calculation of the hash. What I’m finding is that, in some
cases, the User-Name attribute doesn’t match the case of the Name field
in the MS-CHAP response (i.e., the userid is the same, it just differs in case).
In the tests I’ve performed, when these userids don’t match in
case, I get a Logon Failure from ntlm_auth. I’d really like this to
“just work” as is commonly said around these parts without
additional gymnastics (such as changing all userids to lowercase).<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>Does this seem like a plausible explanation for what’s happening?
If not, does anyone have any other ideas? I need to resolve this in order
to retire two old and cranky (and fairly useless because they don’t
really do authorization) ACS servers! I’m going to try a change to rlm_mschap
so it passes the Name field from the MS-CHAP response to the challenge_hash function
(as opposed to the User-Name attribute) to see if that resolves the issue.
I realize that ultimately it’s Windows fault that it doesn’t pass
the userid with consistent case (i.e., Identity vs. MS-CHAP response); but, I
don’t want the ACS server to be seen as a better, more tolerant solution.
So, it would be great to make FR more tolerant of this aberrant behaviour.
<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>Thanks in advance for any advice/help/suggestions you can provide.. <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>Here’s what I tested and what I observed that caused me to draw
the above conclusion:<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>Background: Windows XP SP3 laptop using std. Windows wireless
supplicant EAP/PEAP/MS-CHAPv2 -> Cisco 1232AP -> FR 2.1.6 (with rlm_perl
patch) running on FreeBSD 7.2. In all the tests below, the same SSID,
wireless network configuration on the laptop, AP, userid and password were used
(the domain and user listed below are contrived, but are representative of the
case I saw in the debug output).<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
<table class=MsoTableGrid border=1 cellspacing=0 cellpadding=0
style='border-collapse:collapse;border:none'>
<tr>
<td width=118 valign=top style='width:88.55pt;border:solid windowtext 1.0pt;
padding:0in 5.4pt 0in 5.4pt'>
<p class=MsoNormal><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'>Laptop Logon Method<o:p></o:p></span></font></p>
</td>
<td width=118 valign=top style='width:88.55pt;border:solid windowtext 1.0pt;
border-left:none;padding:0in 5.4pt 0in 5.4pt'>
<p class=MsoNormal><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'>Wireless Credentials Passed Man/Auto<o:p></o:p></span></font></p>
</td>
<td width=159 valign=top style='width:119.55pt;border:solid windowtext 1.0pt;
border-left:none;padding:0in 5.4pt 0in 5.4pt'>
<p class=MsoNormal><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'>MS-CHAP Response Packet Name field<o:p></o:p></span></font></p>
</td>
<td width=151 valign=top style='width:113.55pt;border:solid windowtext 1.0pt;
border-left:none;padding:0in 5.4pt 0in 5.4pt'>
<p class=MsoNormal><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'>User-Name Request Attribute<o:p></o:p></span></font></p>
</td>
<td width=118 valign=top style='width:88.6pt;border:solid windowtext 1.0pt;
border-left:none;padding:0in 5.4pt 0in 5.4pt'>
<p class=MsoNormal><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'>ntlm_auth Authentication Result<o:p></o:p></span></font></p>
</td>
</tr>
<tr>
<td width=118 valign=top style='width:88.55pt;border:solid windowtext 1.0pt;
border-top:none;padding:0in 5.4pt 0in 5.4pt'>
<p class=MsoNormal><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'>Domain logon (via Ethernet) with all lowercase
userid entered on gina<o:p></o:p></span></font></p>
</td>
<td width=118 valign=top style='width:88.55pt;border-top:none;border-left:
none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;
padding:0in 5.4pt 0in 5.4pt'>
<p class=MsoNormal><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'>Manually entered all lowercase userid when
supplicant prompted<o:p></o:p></span></font></p>
</td>
<td width=159 valign=top style='width:119.55pt;border-top:none;border-left:
none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;
padding:0in 5.4pt 0in 5.4pt'>
<p class=MsoNormal><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'>MYDOMAIN\myuser<o:p></o:p></span></font></p>
</td>
<td width=151 valign=top style='width:113.55pt;border-top:none;border-left:
none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;
padding:0in 5.4pt 0in 5.4pt'>
<p class=MsoNormal><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'>MYDOMAIN\myuser<o:p></o:p></span></font></p>
</td>
<td width=118 valign=top style='width:88.6pt;border-top:none;border-left:
none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;
padding:0in 5.4pt 0in 5.4pt'>
<p class=MsoNormal><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'>SUCCESS<o:p></o:p></span></font></p>
</td>
</tr>
<tr>
<td width=118 valign=top style='width:88.55pt;border:solid windowtext 1.0pt;
border-top:none;padding:0in 5.4pt 0in 5.4pt'>
<p class=MsoNormal><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'>Domain logon (via Ethernet) with all lowercase
userid entered on gina<o:p></o:p></span></font></p>
</td>
<td width=118 valign=top style='width:88.55pt;border-top:none;border-left:
none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;
padding:0in 5.4pt 0in 5.4pt'>
<p class=MsoNormal><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'>Supplicant configured to auto. pass Windows credentials<o:p></o:p></span></font></p>
</td>
<td width=159 valign=top style='width:119.55pt;border-top:none;border-left:
none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;
padding:0in 5.4pt 0in 5.4pt'>
<p class=MsoNormal><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'>MYDOMAIN\MyuseR<o:p></o:p></span></font></p>
</td>
<td width=151 valign=top style='width:113.55pt;border-top:none;border-left:
none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;
padding:0in 5.4pt 0in 5.4pt'>
<p class=MsoNormal><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'>MYDOMAIN\myuser<o:p></o:p></span></font></p>
</td>
<td width=118 valign=top style='width:88.6pt;border-top:none;border-left:
none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;
padding:0in 5.4pt 0in 5.4pt'>
<p class=MsoNormal><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'>Logon failure (0xc000006d)<o:p></o:p></span></font></p>
</td>
</tr>
<tr>
<td width=118 valign=top style='width:88.55pt;border:solid windowtext 1.0pt;
border-top:none;padding:0in 5.4pt 0in 5.4pt'>
<p class=MsoNormal><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'>Locally cached credentials (on laptop) with all
lowercase userid entered on gina<o:p></o:p></span></font></p>
</td>
<td width=118 valign=top style='width:88.55pt;border-top:none;border-left:
none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;
padding:0in 5.4pt 0in 5.4pt'>
<p class=MsoNormal><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'>Manually entered all uppercase userid when supplicant
prompted<o:p></o:p></span></font></p>
</td>
<td width=159 valign=top style='width:119.55pt;border-top:none;border-left:
none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;
padding:0in 5.4pt 0in 5.4pt'>
<p class=MsoNormal><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'>MYUSER<o:p></o:p></span></font></p>
</td>
<td width=151 valign=top style='width:113.55pt;border-top:none;border-left:
none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;
padding:0in 5.4pt 0in 5.4pt'>
<p class=MsoNormal><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'>MYUSER<o:p></o:p></span></font></p>
</td>
<td width=118 valign=top style='width:88.6pt;border-top:none;border-left:
none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;
padding:0in 5.4pt 0in 5.4pt'>
<p class=MsoNormal><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'>SUCCESS<o:p></o:p></span></font></p>
</td>
</tr>
<tr>
<td width=118 valign=top style='width:88.55pt;border:solid windowtext 1.0pt;
border-top:none;padding:0in 5.4pt 0in 5.4pt'>
<p class=MsoNormal><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'>Locally cached credentials (on laptop) with all
lowercase userid entered on gina<o:p></o:p></span></font></p>
</td>
<td width=118 valign=top style='width:88.55pt;border-top:none;border-left:
none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;
padding:0in 5.4pt 0in 5.4pt'>
<p class=MsoNormal><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'>Manually entered all lowercase userid when supplicant
prompted<o:p></o:p></span></font></p>
</td>
<td width=159 valign=top style='width:119.55pt;border-top:none;border-left:
none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;
padding:0in 5.4pt 0in 5.4pt'>
<p class=MsoNormal><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'>myuser<o:p></o:p></span></font></p>
</td>
<td width=151 valign=top style='width:113.55pt;border-top:none;border-left:
none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;
padding:0in 5.4pt 0in 5.4pt'>
<p class=MsoNormal><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'>myuser<o:p></o:p></span></font></p>
</td>
<td width=118 valign=top style='width:88.6pt;border-top:none;border-left:
none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;
padding:0in 5.4pt 0in 5.4pt'>
<p class=MsoNormal><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'>SUCCESS<o:p></o:p></span></font></p>
</td>
</tr>
<tr>
<td width=118 valign=top style='width:88.55pt;border:solid windowtext 1.0pt;
border-top:none;padding:0in 5.4pt 0in 5.4pt'>
<p class=MsoNormal><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'>Locally cached credentials (on laptop) with all
lowercase userid entered on gina<o:p></o:p></span></font></p>
</td>
<td width=118 valign=top style='width:88.55pt;border-top:none;border-left:
none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;
padding:0in 5.4pt 0in 5.4pt'>
<p class=MsoNormal><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'>Supplicant configured to auto. pass Windows credentials<o:p></o:p></span></font></p>
</td>
<td width=159 valign=top style='width:119.55pt;border-top:none;border-left:
none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;
padding:0in 5.4pt 0in 5.4pt'>
<p class=MsoNormal><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'>MYDOMAIN\MyuseR<o:p></o:p></span></font></p>
</td>
<td width=151 valign=top style='width:113.55pt;border-top:none;border-left:
none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;
padding:0in 5.4pt 0in 5.4pt'>
<p class=MsoNormal><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'>MYDOMAIN\MyuseR<o:p></o:p></span></font></p>
</td>
<td width=118 valign=top style='width:88.6pt;border-top:none;border-left:
none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;
padding:0in 5.4pt 0in 5.4pt'>
<p class=MsoNormal><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'>SUCCESS<o:p></o:p></span></font></p>
</td>
</tr>
</table>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
</div>
</body>
</html>