Hello,
I have configured *EAP-AKA virtual-server in FreeRADIUS to
perform authentication. *
*I could successfully authenticate the Users, However facing an issue
with fast reauth.*
*I have used eap cache to store the session state. I could load the
session state properly *
*On receiving a fast reauth ID. Still reauth is not continued, rather
it fails saying *
*can't calculate re-auth keys and falling back to full auth.*
I could see following logs :
..
Debug : (2) eap - Peer sent EAP-Identity. Returning 'ok' so we can
short-circuit the rest of authorize
Debug : (2) eap - Setting &control.Auth-Type = eap
Debug : (2) eap (ok)
Debug : (2) } # recv Access-Request (ok)
Debug : (2) default - Running 'authenticate eap' from file
/usr/local/etc/raddb/sites-enabled/default
Debug : (2) default - authenticate eap {
Debug : (2) eap - New EAP session started
Debug : (2) eap - Peer sent packet with EAP method Identity (1)
Debug : (2) eap - Calling submodule eap_aka
Debug : (2) eap - subrequest {
Debug : (2.0) h9-auth-server - recv Identity-Response {
Debug : (2.0) h9-auth-server - ok (ok)
Debug : (2.0) h9-auth-server - } # recv Identity-Response (ok)
Debug : (2.0) h9-auth-server - New EAP-AKA session
Debug : (2.0) h9-auth-server - Changed state INIT -> REAUTHENTICATION
Debug : (2.0) h9-auth-server - load session {
Debug : (2.0) eap_aka_cache - | eap-aka-sim.Session-ID
Debug : (2.0) eap_aka_cache - | %{eap-aka-sim.Session-ID}
Debug : (2.0) eap_aka_cache - | --> 0x346844533743546c516f736a376d62
Debug : (2.0) eap_aka_cache - --> 0x346844533743546c516f736a376d62
Debug : (2.0) eap_aka_cache - Found entry for
"0x346844533743546c516f736a376d62"
Debug : (2.0) eap_aka_cache - Merging cache entry into request
Debug : (2.0) eap_aka_cache - &session-State[0].Permanent-Identity
:= '10026000000000(a)wlan.mnc11343.mcc0.3gppnetwork.org'
Debug : (2.0) eap_aka_cache - &session-State[0].Session-Data :=
0xab32a5be4d8309d4a40938e425ef1714d71cf87a
Debug : (2.0) eap_aka_cache - &session-State[0].Encr-Data.Counter :=
0
Debug : (2.0) h9-auth-server - eap_aka_cache (updated)
Debug : (2.0) h9-auth-server - ok (ok)
Debug : (2.0) h9-auth-server - } # load session (updated)
Debug : (2.0) h9-auth-server - send Reauthentication-Request {
Debug : (2.0) h9-auth-server - &reply.Encr-Data.Next-Reauth-Id :=
Debug : (2.0) h9-auth-server - &reply.Encr-Data.Next-Pseudonym :=
Debug : (2.0) h9-auth-server - | debug_attr
INFO : (2.0) h9-auth-server - Attributes matching "&session-state"
INFO : (2.0) h9-auth-server - &session-State.session-State = {
INFO : (2.0) h9-auth-server - Permanent-Identity =
10026000000000(a)wlan.mnc11343.mcc0.3gppnetwork.org
INFO : (2.0) h9-auth-server - Session-Data =
0xab32a5be4d8309d4a40938e425ef1714d71cf87a
INFO : (2.0) h9-auth-server - Counter = 0
INFO : (2.0) h9-auth-server - }
Debug : (2.0) h9-auth-server - | %(debug_attr:{&session-state})
Debug : (2.0) h9-auth-server - | --> (null)
Debug : (2.0) h9-auth-server - ok (ok)
Debug : (2.0) h9-auth-server - } # send Reauthentication-Request (ok)
Debug : (2.0) h9-auth-server - Generating new session keys
Debug : (2.0) h9-auth-server - Neither &session-state.Session-Data or
&session-state.MK attributes found, can't calculate re-auth keys
>>>>>>>>>>>>>>>>>>>>> Getting this error, however I could see session-state
has Session-Data loaded.
Debug : (2.0) h9-auth-server - Composing EAP-Request/Reauthentication
failed. Clearing reply attributes and requesting additional Identity
Debug : (2.0) h9-auth-server - Changed state REAUTHENTICATION ->
AKA-IDENTITY
Debug : (2.0) h9-auth-server - send Identity-Request {
Debug : (2.0) h9-auth-server - ok (ok)
Debug : (2.0) h9-auth-server - } # send Identity-Request (ok)
And then it falls back to full authentication...
Summary of my setup:
* FreeRadius version4 - Configured, compiled and installed from
master Branch
* wpa_supplicant version 2.10
* Ubuntu 20.04 LTS
Any help would be greatly appreciated. Thank you in advance.
Thanks,
Deepika
