Hello, you have configured the EAP type EAP-MD5, which is not allowed in eduroam. And it's not used anywhere else in WPA-Enterprise since a decade, too. Other than that, nothing's wrong - the EAP conversation is started by the client, and your server responds with an Access-Challenge. The next step would be that the client continues the conversation and carries on with EAP. Maybe it doesn't do that because EAP-MD5 is dead since a decade. But the server log doesn't tell you what the client thinks. First, get rid of the EAP-MD5 configuration and then you can look further. Greetings, Stefan Winter Am 17.04.19 um 09:59 schrieb Tal Nur via Freeradius-Users:
Dear colleagues
I'm trying to setup Freeradius IdP server for Eduroam service. I followed the "how-tos" on wiki.geant.org but during the test of my setup I'd got the following error messages: =============================================================================== Ready to process requests (1) Received Access-Request Id 0 from 89.250.80.136:1117 to 89.250.80.130:1812 length 213 (1) Message-Authenticator = 0x0083de2f19d2f059d3d800138a6f7374 (1) Service-Type = Framed-User (1) User-Name = "sake@kazrena.kz" (1) Framed-MTU = 1488 (1) Called-Station-Id = "00-22-B0-0C-84-71:eduroam" (1) Calling-Station-Id = "18-F4-6A-33-41-A5" (1) NAS-Identifier = "D-Link Access Point" (1) NAS-Port-Type = Wireless-802.11 (1) Connect-Info = "CONNECT 54Mbps 802.11g" (1) EAP-Message = 0x020000140173616b65406b617a72656e612e6b7a (1) NAS-IP-Address = 89.250.80.136 (1) NAS-Port = 1 (1) NAS-Port-Id = "STA port # 1" (1) # Executing section authorize from file /etc/freeradius/sites-enabled/eduroam (1) authorize { (1) policy filter_username { (1) if (&User-Name) { (1) if (&User-Name) -> TRUE (1) if (&User-Name) { (1) if (&User-Name =~ / /) { (1) ERROR: regex failed: Found null in subject at offset 15. String unsafe for evaluation (1) ERROR: Failed retrieving values required to evaluate condition (1) if (&User-Name =~ /@[^@]*@/ ) { (1) ERROR: regex failed: Found null in subject at offset 15. String unsafe for evaluation (1) ERROR: Failed retrieving values required to evaluate condition (1) if (&User-Name =~ /\.\./ ) { (1) ERROR: regex failed: Found null in subject at offset 15. String unsafe for evaluation (1) ERROR: Failed retrieving values required to evaluate condition (1) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { (1) ERROR: regex failed: Found null in subject at offset 15. String unsafe for evaluation (1) ERROR: Failed retrieving values required to evaluate condition (1) if (&User-Name =~ /\.$/) { (1) ERROR: regex failed: Found null in subject at offset 15. String unsafe for evaluation (1) ERROR: Failed retrieving values required to evaluate condition (1) if (&User-Name =~ /@\./) { (1) ERROR: regex failed: Found null in subject at offset 15. String unsafe for evaluation (1) ERROR: Failed retrieving values required to evaluate condition (1) } # if (&User-Name) = notfound (1) } # policy filter_username = notfound (1) update request { (1) Operator-Name := "1kazrena.kz" (1) } # update request = noop (1) auth_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (1) auth_log: --> /var/log/freeradius/radacct/89.250.80.136/auth-detail-20190417 (1) auth_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/89.250.80.136/auth-detail-20190417 (1) auth_log: EXPAND %t (1) auth_log: --> Wed Apr 17 10:11:36 2019 (1) [auth_log] = ok (1) suffix: Checking for suffix after "@" (1) suffix: Looking up realm "kazrena.kz" for User-Name = "sake@kazrena.kz" (1) suffix: Found realm "kazrena.kz" (1) suffix: Adding Realm = "kazrena.kz" (1) suffix: Authentication realm is LOCAL (1) [suffix] = ok rlm_sql (sql): Reserved connection (1) rlm_sql (sql): Released connection (1) (1) [sql] = notfound (1) eap: Peer sent EAP Response (code 2) ID 0 length 20 (1) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (1) [eap] = ok (1) } # authorize = ok (1) Found Auth-Type = eap (1) # Executing group from file /etc/freeradius/sites-enabled/eduroam (1) authenticate { (1) eap: Peer sent packet with method EAP Identity (1) (1) eap: Calling submodule eap_md5 to process data (1) eap_md5: Issuing MD5 Challenge (1) eap: Sending EAP Request (code 1) ID 1 length 22 (1) eap: EAP session adding &reply:State = 0x3afb18fa3afa1cb6 (1) [eap] = handled (1) } # authenticate = handled (1) Using Post-Auth-Type Challenge (1) Post-Auth-Type sub-section not found. Ignoring. (1) # Executing group from file /etc/freeradius/sites-enabled/eduroam (1) Sent Access-Challenge Id 0 from 89.250.80.130:1812 to 89.250.80.136:1117 length 0 (1) EAP-Message = 0x010100160410cc91782bcf8cf2f0b4de0ed50943dc6e (1) Message-Authenticator = 0x00000000000000000000000000000000 (1) State = 0x3afb18fa3afa1cb6e9d755993b5205d3 (1) Finished request =======================================================================================
I couldn't understand what's configured wrong. Could you advice me what to do to fix the problem?
Regards, Talgat Nurlybayev - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 2, avenue de l'Université L-4365 Esch-sur-Alzette Tel: +352 424409 1 Fax: +352 422473 PGP key updated to 4096 Bit RSA - I will encrypt all mails if the recipient's key is known to me http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66