Hello, I have configured *EAP-AKA virtual-server in FreeRADIUS to perform authentication. * *I could successfully authenticate the Users, However facing an issue with fast reauth.* *I have used eap cache to store the session state. I could load the session state properly * *On receiving a fast reauth ID. Still reauth is not continued, rather it fails saying * *can't calculate re-auth keys and falling back to full auth.* I could see following logs : .. Debug : (2) eap - Peer sent EAP-Identity. Returning 'ok' so we can short-circuit the rest of authorize Debug : (2) eap - Setting &control.Auth-Type = eap Debug : (2) eap (ok) Debug : (2) } # recv Access-Request (ok) Debug : (2) default - Running 'authenticate eap' from file /usr/local/etc/raddb/sites-enabled/default Debug : (2) default - authenticate eap { Debug : (2) eap - New EAP session started Debug : (2) eap - Peer sent packet with EAP method Identity (1) Debug : (2) eap - Calling submodule eap_aka Debug : (2) eap - subrequest { Debug : (2.0) h9-auth-server - recv Identity-Response { Debug : (2.0) h9-auth-server - ok (ok) Debug : (2.0) h9-auth-server - } # recv Identity-Response (ok) Debug : (2.0) h9-auth-server - New EAP-AKA session Debug : (2.0) h9-auth-server - Changed state INIT -> REAUTHENTICATION Debug : (2.0) h9-auth-server - load session { Debug : (2.0) eap_aka_cache - | eap-aka-sim.Session-ID Debug : (2.0) eap_aka_cache - | %{eap-aka-sim.Session-ID} Debug : (2.0) eap_aka_cache - | --> 0x346844533743546c516f736a376d62 Debug : (2.0) eap_aka_cache - --> 0x346844533743546c516f736a376d62 Debug : (2.0) eap_aka_cache - Found entry for "0x346844533743546c516f736a376d62" Debug : (2.0) eap_aka_cache - Merging cache entry into request Debug : (2.0) eap_aka_cache - &session-State[0].Permanent-Identity := '10026000000000@wlan.mnc11343.mcc0.3gppnetwork.org' Debug : (2.0) eap_aka_cache - &session-State[0].Session-Data := 0xab32a5be4d8309d4a40938e425ef1714d71cf87a Debug : (2.0) eap_aka_cache - &session-State[0].Encr-Data.Counter := 0 Debug : (2.0) h9-auth-server - eap_aka_cache (updated) Debug : (2.0) h9-auth-server - ok (ok) Debug : (2.0) h9-auth-server - } # load session (updated) Debug : (2.0) h9-auth-server - send Reauthentication-Request { Debug : (2.0) h9-auth-server - &reply.Encr-Data.Next-Reauth-Id := Debug : (2.0) h9-auth-server - &reply.Encr-Data.Next-Pseudonym := Debug : (2.0) h9-auth-server - | debug_attr INFO : (2.0) h9-auth-server - Attributes matching "&session-state" INFO : (2.0) h9-auth-server - &session-State.session-State = { INFO : (2.0) h9-auth-server - Permanent-Identity = 10026000000000@wlan.mnc11343.mcc0.3gppnetwork.org INFO : (2.0) h9-auth-server - Session-Data = 0xab32a5be4d8309d4a40938e425ef1714d71cf87a INFO : (2.0) h9-auth-server - Counter = 0 INFO : (2.0) h9-auth-server - } Debug : (2.0) h9-auth-server - | %(debug_attr:{&session-state}) Debug : (2.0) h9-auth-server - | --> (null) Debug : (2.0) h9-auth-server - ok (ok) Debug : (2.0) h9-auth-server - } # send Reauthentication-Request (ok) Debug : (2.0) h9-auth-server - Generating new session keys Debug : (2.0) h9-auth-server - Neither &session-state.Session-Data or &session-state.MK attributes found, can't calculate re-auth keys
>>>>>>>>>>>>>>> Getting this error, however I could see session-state has Session-Data loaded.
Debug : (2.0) h9-auth-server - Composing EAP-Request/Reauthentication failed. Clearing reply attributes and requesting additional Identity Debug : (2.0) h9-auth-server - Changed state REAUTHENTICATION -> AKA-IDENTITY Debug : (2.0) h9-auth-server - send Identity-Request { Debug : (2.0) h9-auth-server - ok (ok) Debug : (2.0) h9-auth-server - } # send Identity-Request (ok) And then it falls back to full authentication... Summary of my setup: * FreeRadius version4 - Configured, compiled and installed from master Branch * wpa_supplicant version 2.10 * Ubuntu 20.04 LTS Any help would be greatly appreciated. Thank you in advance. Thanks, Deepika