Hi On 26 August 2010 23:35, Alan DeKok <aland@deployingradius.com> wrote:
Jean-Yves Avenard wrote:
I am running freeradius that comes installed and configured with MacOS 10.6 server.
A Windows XP can connect just fine using Microsoft Protected EAP. iPhone, mac os client connect just fine using EAP-TTLS
Windows 7 will connect fine using Securew2 EAP-TTLS supplicant ; but not with the default build-in PEAP.
The log you posted shows a clear issue:
When connecting with Windows 7, I would read:
Thu Aug 26 02:21:52 2010 : Auth: rlm_opendirectory: Could not get the user's uuid. Thu Aug 26 02:21:53 2010 : Error: rlm_mschap: getUserNodeRef(): dsGetRecordList() status = 0, recCount=0
Any hint about what I should be looking at?
Run the server in debugging mode (radiusd -X). Look for the above errors, and *read* the lines of text around them.
Then use the information from the debug output to look the user up in OpenDirectory. Odds are that the user doesn't exist, which is why it can't get the UUID.
Mind new, I'm a complete noob when it comes to radius, I only started playing with it 2 days ago.
This isn't much of a RADIUS error. The user lookup in OpenDirectory fails, and the UUID wasn't found. The only issue is *who* was being looked up, and *why* the UUID wasn't found.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Allright... Here are some logs... rad_recv: Access-Request packet from host 192.168.0.20 port 65513, id=51, length=163 User-Name = "host/ramon" NAS-IP-Address = 192.168.0.20 NAS-Port = 0 Called-Station-Id = "00-1C-B3-AD-13-5F:HYDRIX-TEST" Calling-Station-Id = "C4-46-19-25-31-52" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x027e000f01686f73742f72616d6f6e Message-Authenticator = 0x4f4536256e97a2b596511e8560ef07ca +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "host/ramon", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 126 length 15 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop rlm_opendirectory: The host 192.168.0.20 does not have an access group. rlm_opendirectory: Could not get the user's uuid. ++[opendirectory] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [snip] By default it tries to connect with the computer name rather than the user name.. Going into the Advanced option, I can force the type of authentication use to "User Authentication"...
From there it worked ...