- Freeradius-Users - lists.freeradius.org

Re: Re: Cisco WLC PEAP/MSCHAPv2 - unnecessary ldap lookups?
by Brian Wilson 18 Sep '09

18 Sep '09

I will need to do some more research on inner-tunnels, as i'm not too familiar with them. How would I add the ldap components? as part of the peap module itself? All the documentation i've found on LDAP requires the ldap modules to be referenced in both the authorize and authentication sections directly. It would be useful to see some more examples. -----Inline Message Follows----- Have you tried to configure an inner-tunnel for peap? it will reduce the ldap lookups. 2009/9/17 Brian Wilson <briw111(a)yahoo.com>: > Hi all, > > A few months ago I had posted this topic to the list, and unfortunately > before I could work further on it I got pulled onto another assignment. I > apologize to those that tried helping before. I modified my config per > their recommendations, but still having the same problem.... > > I am still having trouble with a WLC440x with WPA2-AES-PEAP-MSCHAPv2, > freeradius and edirectory setup. Essentially, the ldap requests are taking > 3-4 seconds to resolve. In addition, freeradius ends up doing in the > neighborhood of 5-6 ldap lookups for each client trying to attach. I am > unsure of why this is happening. Below is my configuration: (This is > freeradius 2.1.6) > > authorize{ > preprocess > auth_log > suffix > ntdomain > eap { > ok = return > } > files { > notfound = reject > noop = reject > fail = reject > } > redundant-load-balance { > LDAPsvr1 > LDAPsvr2 > } > expiration > logintime > } > > authenticate { > Auth-Type MS-CHAP { > mschap > } > Auth-Type LDAP { > redundant-load-balance { > LDAPsvr1 > LDAPsvr2 > } > } > eap > } > > and in eap.conf, i have default-eap-type set to peap, and not mschapv2. > > > here is a snippet of debug info I had posted before; this tends to repeat at > nassuem about 4-5 more times before the actual access-accept is sent: > > > > rad_recv: Access-Request packet from host blah port 32769, id=5, length=196 > User-Name = "test" > Calling-Station-Id = "mac" > Called-Station-Id = "mac:blah" > NAS-Port = 1 > NAS-IP-Address = ipblah > > NAS-Identifier = "nameblah" > Airespace-Wlan-Id = 2 > Service-Type = Framed-User > Framed-MTU = 1300 > NAS-Port-Type = Wireless-802.11 > EAP-Message = (trimmed) > Message-Authenticator = 0x8dd02304de9a3c5e3c732d1a622be134 > +- entering group authorize {...} > [preprocess] expand: %{Called-Station-Id} -> mac:blah > > ++[preprocess] returns ok > [auth_log] expand: (trimmed) > [auth_log](trimmed) > [auth_log] expand: %t -> Wed Jun 17 10:00:10 2009 > ++[auth_log] returns ok > ++[mschap] returns noop > [suffix] No '@' in User-Name = "test", looking up realm NULL > [suffix] No such realm "NULL" > ++[suffix] returns noop > [ntdomain] Looking up realm "company" for User-Name = "test" > [ntdomain] Found realm "company" > [ntdomain] Adding Stripped-User-Name = "test" > [ntdomain] Adding Realm = "company" > [ntdomain] Authentication realm is LOCAL. > ++[ntdomain] returns ok > [eap] EAP packet type response id 2 length 27 > [eap] No EAP Start, assuming it's an on-going EAP conversation > ++[eap] returns updated > [files] users: Matched entry DEFAULT at line 178 > ++[files] returns ok > ++- entering redundant-load-balance group redundant-load-balance {...} > [LDAPsvr2] performing user authorization for test > [LDAPsvr2] WARNING: Deprecated conditional expansion ":-". See "man unlang" > for details > [LDAPsvr2] expand: (cn=%{Stripped-User-Name:-%{User-Name}}) -> (cn=test) > [LDAPsvr2] expand: t=company -> t=company > rlm_ldap: ldap_get_conn: Checking Id: 0 > rlm_ldap: ldap_get_conn: Got Id: 0 > rlm_ldap: performing search in t=company, with filter (cn=test) > [LDAPsvr2] Added the eDirectory password password in check items as > Cleartext-Password > [LDAPsvr2] No default NMAS login sequence > [LDAPsvr2] looking for check items in directory... > [LDAPsvr2] looking for reply items in directory... > [LDAPsvr2] user test authorized to use remote access > rlm_ldap: ldap_release_conn: Release Id: 0 > +++[LDAPsvr2] returns ok > ++- redundant-load-balance group redundant-load-balance returns ok > ++[expiration] returns noop > ++[logintime] returns noop > Found Auth-Type = EAP > +- entering group authenticate {...} > [eap] EAP Identity > [eap] processing type mschapv2 > rlm_eap_mschapv2: Issuing Challenge > ++[eap] returns handled > Sending Access-Challenge of id 5 to blah port 32769 > EAP-Message = (trimmed) > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0xfea96b9cfeaa7186011d5bcc3cb2528f > Finished request 67. > Going to the next request > Waking up in 9.9 seconds. > rad_recv: Access-Request packet from host blah port 32769, id=6, length=193 > User-Name = "test" > Calling-Station-Id = "mac" > Called-Station-Id = "mac:blah" > NAS-Port = 1 > NAS-IP-Address = blah > > NAS-Identifier = "nameblah" > Airespace-Wlan-Id = 2 > Service-Type = Framed-User > Framed-MTU = 1300 > NAS-Port-Type = Wireless-802.11 > EAP-Message = 0x020300060319 > State = 0xfea96b9cfeaa7186011d5bcc3cb2528f > Message-Authenticator = 0x7efad720ed506e1d3324a14c5f001a4c > +- entering group authorize {...} > [preprocess] expand: %{Called-Station-Id} -> mac:blah > ++[preprocess] returns ok > [auth_log] expand: (trimmed) > [auth_log] (trimmed) > [auth_log] expand: (trimmed) > ++[auth_log] returns ok > ++[mschap] returns noop > [suffix] No '@' in User-Name = "test", looking up realm NULL > [suffix] No such realm "NULL" > ++[suffix] returns noop > [ntdomain] Looking up realm "company" for User-Name = "test" > [ntdomain] Found realm "company" > [ntdomain] Adding Stripped-User-Name = "test" > [ntdomain] Adding Realm = "company" > [ntdomain] Authentication realm is LOCAL. > ++[ntdomain] returns ok > [eap] EAP packet type response id 3 length 6 > [eap] No EAP Start, assuming it's an on-going EAP conversation > ++[eap] returns updated > [files] users: Matched entry DEFAULT at line 178 > ++[files] returns ok > ++- entering redundant-load-balance group redundant-load-balance {...} > [LDAPsvr1] performing user authorization for test > [LDAPsvr1] WARNING: Deprecated conditional expansion ":-". See "man unlang" > for details > [LDAPsvr1] expand: (cn=%{Stripped-User-Name:-%{User-Name}}) -> (cn=test) > [LDAPsvr1] expand: t=company -> t=company > rlm_ldap: ldap_get_conn: Checking Id: 0 > rlm_ldap: ldap_get_conn: Got Id: 0 > rlm_ldap: performing search in t=company, with filter (cn=test) > [LDAPsvr1] Added the eDirectory password password in check items as > Cleartext-Password > [LDAPsvr1] No default NMAS login sequence > [LDAPsvr1] looking for check items in directory... > [LDAPsvr1] looking for reply items in directory... > [LDAPsvr1] user test authorized to use remote access > rlm_ldap: ldap_release_conn: Release Id: 0 > +++[LDAPsvr1] returns ok > ++- redundant-load-balance group redundant-load-balance returns ok > ++[expiration] returns noop > ++[logintime] returns noop > Found Auth-Type = EAP > +- entering group authenticate {...} > [eap] Request found, released from the list > [eap] EAP NAK > [eap] EAP-NAK asked for EAP-Type/peap > [eap] processing type tls > [tls] Initiate > [tls] Start returned 1 > ++[eap] returns handled > Sending Access-Challenge of id 6 to blah port 32769 > EAP-Message = 0x010400061920 > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0xfea96b9cffad7286011d5bcc3cb2528f > Finished request 68. > Going to the next request > Waking up in 5.2 seconds. > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

4 3

Cisco WLC PEAP/MSCHAPv2 - unnecessary ldap lookups?
by Brian Wilson 17 Sep '09

17 Sep '09

Hi all, A few months ago I had posted this topic to the list, and unfortunately before I could work further on it I got pulled onto another assignment. I apologize to those that tried helping before. I modified my config per their recommendations, but still having the same problem.... I am still having trouble with a WLC440x with WPA2-AES-PEAP-MSCHAPv2, freeradius and edirectory setup. Essentially, the ldap requests are taking 3-4 seconds to resolve. In addition, freeradius ends up doing in the neighborhood of 5-6 ldap lookups for each client trying to attach. I am unsure of why this is happening. Below is my configuration: (This is freeradius 2.1.6) authorize{ preprocess auth_log suffix ntdomain eap { ok = return } files { notfound = reject noop = reject fail = reject } redundant-load-balance { LDAPsvr1 LDAPsvr2 } expiration logintime } authenticate { Auth-Type MS-CHAP { mschap } Auth-Type LDAP { redundant-load-balance { LDAPsvr1 LDAPsvr2 } } eap } and in eap.conf, i have default-eap-type set to peap, and not mschapv2. here is a snippet of debug info I had posted before; this tends to repeat at nassuem about 4-5 more times before the actual access-accept is sent: rad_recv: Access-Request packet from host blah port 32769, id=5, length=196 User-Name = "test" Calling-Station-Id = "mac" Called-Station-Id = "mac:blah" NAS-Port = 1 NAS-IP-Address = ipblah NAS-Identifier = "nameblah" Airespace-Wlan-Id = 2 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 EAP-Message = (trimmed) Message-Authenticator = 0x8dd02304de9a3c5e3c732d1a622be134 +- entering group authorize {...} [preprocess] expand: %{Called-Station-Id} -> mac:blah ++[preprocess] returns ok [auth_log] expand: (trimmed) [auth_log](trimmed) [auth_log] expand: %t -> Wed Jun 17 10:00:10 2009 ++[auth_log] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [ntdomain] Looking up realm "company" for User-Name = "test" [ntdomain] Found realm "company" [ntdomain] Adding Stripped-User-Name = "test" [ntdomain] Adding Realm = "company" [ntdomain] Authentication realm is LOCAL. ++[ntdomain] returns ok [eap] EAP packet type response id 2 length 27 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 178 ++[files] returns ok ++- entering redundant-load-balance group redundant-load-balance {...} [LDAPsvr2] performing user authorization for test [LDAPsvr2] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [LDAPsvr2] expand: (cn=%{Stripped-User-Name:-%{User-Name}}) -> (cn=test) [LDAPsvr2] expand: t=company -> t=company rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in t=company, with filter (cn=test) [LDAPsvr2] Added the eDirectory password password in check items as Cleartext-Password [LDAPsvr2] No default NMAS login sequence [LDAPsvr2] looking for check items in directory... [LDAPsvr2] looking for reply items in directory... [LDAPsvr2] user test authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 +++[LDAPsvr2] returns ok ++- redundant-load-balance group redundant-load-balance returns ok ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 5 to blah port 32769 EAP-Message = (trimmed) Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfea96b9cfeaa7186011d5bcc3cb2528f Finished request 67. Going to the next request Waking up in 9.9 seconds. rad_recv: Access-Request packet from host blah port 32769, id=6, length=193 User-Name = "test" Calling-Station-Id = "mac" Called-Station-Id = "mac:blah" NAS-Port = 1 NAS-IP-Address = blah NAS-Identifier = "nameblah" Airespace-Wlan-Id = 2 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020300060319 State = 0xfea96b9cfeaa7186011d5bcc3cb2528f Message-Authenticator = 0x7efad720ed506e1d3324a14c5f001a4c +- entering group authorize {...} [preprocess] expand: %{Called-Station-Id} -> mac:blah ++[preprocess] returns ok [auth_log] expand: (trimmed) [auth_log] (trimmed) [auth_log] expand: (trimmed) ++[auth_log] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [ntdomain] Looking up realm "company" for User-Name = "test" [ntdomain] Found realm "company" [ntdomain] Adding Stripped-User-Name = "test" [ntdomain] Adding Realm = "company" [ntdomain] Authentication realm is LOCAL. ++[ntdomain] returns ok [eap] EAP packet type response id 3 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 178 ++[files] returns ok ++- entering redundant-load-balance group redundant-load-balance {...} [LDAPsvr1] performing user authorization for test [LDAPsvr1] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [LDAPsvr1] expand: (cn=%{Stripped-User-Name:-%{User-Name}}) -> (cn=test) [LDAPsvr1] expand: t=company -> t=company rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in t=company, with filter (cn=test) [LDAPsvr1] Added the eDirectory password password in check items as Cleartext-Password [LDAPsvr1] No default NMAS login sequence [LDAPsvr1] looking for check items in directory... [LDAPsvr1] looking for reply items in directory... [LDAPsvr1] user test authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 +++[LDAPsvr1] returns ok ++- redundant-load-balance group redundant-load-balance returns ok ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/peap [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 6 to blah port 32769 EAP-Message = 0x010400061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfea96b9cffad7286011d5bcc3cb2528f Finished request 68. Going to the next request Waking up in 5.2 seconds.

4 3

Re: Re: Configuration for md5 not working
by David Mitton 17 Sep '09

17 Sep '09

From: From: Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> Sep 17, 2009 04:28:13 AM, freeradius-users(a)lists.freeradius.org wrote: >Hi, > >> I have everything configured for md5 authentication so that I do not need to >> use either server or client-side certificates. I have my access points >> configured in /etc/raddb/clients.conf and my users configured in >> /etc/raddb/users >> >>>> > My access point is set to WPA Enterprise security using a RADIUS server. > >cool. last time i checked you couldnt use MD5 as a method for wireless 802.1X >- there are only certain EAP types that can be used - PEAP, EAP-TLS, EAP-TTLS >etc being some of them. Microsoft has disabled MD5 in recent releases. If you really want to use it, you have to figure out how to reenable it. You can, but that's an exercise for the reader. For WPA wireless encryption, you must use an EAP method that generates encryption keys. MD5 does not. Neither does GTC. If you need to use clear text passwords, the "fix" is to run the method inside of PEAP or TTLS, which will generate keys and protect your passwords in the air. > MD5 is fine for wired because - ha ha - wired 802.1X >is a bit of a joke really - all it does is authenticate you, there is no Um, I don't get the "joke"? How is that different than normal NAS PPP dial-up access that RADIUS was originally designed for? Most people using wired 802.1X only need network access control. Wireless is the special case here. And the encryption only covers the connection between the station and the access point. If you want to protect your data on a physical wire, use a VPN or IPSEC. Dave Mitton. >link layer encryption going on - unlike WPA Enterprise wireless - which all gets >encapsulated in an EAP tunnel - hence you need specific types of EAP for wifi >... >alan

3 2

Support
by Gary Gatten 17 Sep '09

17 Sep '09

Hi Alan, I want to support your efforts and it seems I don't have the time to get FR fully integrated into my environment. Ill be putting in a request today to authorize a support contract with you. Should I just follow the docs on the web for the support info? ----- Original Message ----- From: freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org <freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Thu Sep 17 07:13:41 2009 Subject: First steps towards RadSec support Now that version 2.1.7 has been released, the git repository has been updated with the first step to RadSec support. For now, it only provides RADIUS transport over TCP, as per the following document: http://tools.ietf.org/html/draft-dekok-radext-tcp-transport-01 Using "bare" TCP without TLS is't a good idea in most cases. But it's useful for testing, and can help with the transition to RadSec. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>

1 0

simulation of the radius
by Magui 17 Sep '09

17 Sep '09

Hello ,some body know if exist a software platform for simulation of the radius out of an production envairoment. I configure radius in my first upon with pgsql an "freeradius -X" give me freeradius listen 1813 1815 1817 ports for auth pass an proxy and waiting request seemingly ok. But i need to prove it without a NAS ,for work reason i can not affect the services with a prove Some body know if i can use for a prove with radius a modem, a software or some thing thus -- Este mensaje le ha llegado mediante el servicio de correo electronico que ofrece Infomed para respaldar el cumplimiento de las misiones del Sistema Nacional de Salud. La persona que envia este correo asume el compromiso de usar el servicio a tales fines y cumplir con las regulaciones establecidas Infomed: http://www.sld.cu/

7 8

Configuration for md5 not working
by Jon Standley 17 Sep '09

17 Sep '09

Running freeradius 2.1.6 on CentOS 5.3 I have everything configured for md5 authentication so that I do not need to use either server or client-side certificates. I have my access points configured in /etc/raddb/clients.conf and my users configured in /etc/raddb/users My access point is set to WPA Enterprise security using a RADIUS server. When I try to connect to the network, all I get is "Windows is unable to connect to the wireless network" No prompt for username/password or anything. Can someone tell me if its my radius configuration that is bad or my access point or what? Thanks

3 2

freeradius2 exited when running in multi-server mode
by CHui 17 Sep '09

17 Sep '09

I am testing freeRadius 2.1.6 running on FreeBSD kernel 7.2 i386. The freeradius2 is configured to do ldap authentication and authentication worked without any issue. However, radiusd exited unexpectedly during a simple stress test. I used a sh script to issue the "radtest user pwd . &" command in a loop to simulate radius client authentication request. When freeradius2 was invoked with the following command "radiusd -d /usr/operator/raddb/", thus running in multi-server mode, it exited within a few minutes. There was no trace of runtime error nor coredump (did try allow_core_dump=yes). If I run freeradius2 in single-server mode with the command "radiusd -s -d /usr/operator/raddb/", it held up quite well. I don't mind running freeradius2 in single-server mode as it appears to handle the load quite well during the test. Is it recommended though? Any suggestion on work around? Thanks CHui

2 1

Upgrading from 2.1.6 to 2.1.7
by Phil Pierotti 17 Sep '09

17 Sep '09

Hi All, So I'm on Ubuntu Hardy Heron, currently running FreeRADIUS 2.1.6, and have just downloaded 2.1.7 ./configure ; make ; make install No complaints other than the expected "config files are more recent, you'll need to fix that yourself, we won't touch it". Running the new radiusd produces an error: # radiusd -X radiusd: error while loading shared libraries: libfreeradius-radius-2.1.7.so: cannot open shared object file: No such file or directory # locate libfreeradius-radius-2.1.7.so /usr/local/lib/libfreeradius-radius-2.1.7.so mm ok, so it's there (NB right beside the -2.1.6 libraries). And they both have the same permissions. Also, if I then go to my 2.1.6 source dir, and re-run make install, I am back to a working 2.1.6 installation. What am I missing? Thanks, Phil P

2 2

Cannot upgrade 2.1.4 to 2.1.6
by kachin Agarwal 17 Sep '09

17 Sep '09

m trying to upgrade freeradius-server from 2.1.4 to 2.1.6. i ve created some patches and applied it. but while compiling, it patches all the files and then gives me an error as below : /opt/wios/gcc-4.2.2-glibc-2.7- p2/mips-xlr-linux-gnu/lib/gcc/ mips-xlr-linux-gnu/4.2.2/../.. /../../mips-xlr-linux-gnu/bin/ ld: warning: libfreeradius-radius-2.1.6.so, needed by libeap/.libs/libfreeradius- eap.so, not found (try using -rpath or -rpath-link) collect2: ld returned 1 exit status make[7]: *** [radeapclient] Error 1 make[6]: *** [common] Error 2 make[5]: *** [all] Error 2 make[4]: *** [common] Error 2 make[3]: *** [all] Error 2 make[2]: *** [common] Error 2 make[1]: *** [all] Error 2 make: *** [*/*/*/*/*/freeradius-server- 2.1.6/src/main/radiusd] Error 2 i think it fails to link plz give me a solution to this problem. From cricket scores to your friends. Try the Yahoo! India Homepage! http://in.yahoo.com/trynew

1 0

need help for adding VSA dictionary in Freeradius 2.1.6
by Salim Engin 17 Sep '09

17 Sep '09

Hello, I have problem in adding new VSA dictionary file into Freeradius 2.1.6. Below you can find the steps I performed; - create the file named *dictionary.alcatel.esam* with the following content in */usr/local/share/freeradius/* folder; # # VENDOR Alcatel-ESAM 637 BEGIN-VENDOR Alcatel-ESAM ATTRIBUTE A-ESAM-VRF-Name 0x0700 string ATTRIBUTE A-ESAM-Vlan-Id 0x0701 integer ATTRIBUTE A-ESAM-QOS-Profile-Name 0x0702 string ATTRIBUTE A-ESAM-QOS-Params 0x0703 string ATTRIBUTE A-ESAM-Termination-Cause 0x0704 integer # . . END-VENDOR Alcatel-ESAM - add the line below into */usr/local/share/freeradius/dictionary* file; $INCLUDE dictionary.netscreen $INCLUDE dictionary.networkphysics $INCLUDE dictionary.nexans $INCLUDE dictionary.ntua $INCLUDE dictionary.nokia *$INCLUDE dictionary.alcatel.esam* - start radiusd with debugging option. I get the following error message (radiusd -X ) ; *including dictionary file /usr/local/etc/raddb/dictionary Errors reading dictionary: dict_init: /usr/local/share/freeradius/dictionary.alcatel.esam[9]: dict_init: /usr/local/share/freeradius/dictionary.alcatel.esam[9]: * According to my analysis, freeradius does not like the hex values in the VSA dictionary file i.e : 0x0700 . So I tried to make it decimal which is 1792 but still getting the same error message. It seems those attribute numbers should be in a lower range, because if I start from 1 , and I don't get the message in question. But in this case, the attribute becomes unknown resulting in having not applied while user authentication. Is there a way to overcome this problem ? Thanks Salim Engin

5 8