Windows 7 prompting several times
Hi all, Apologies for being slightly off topic. Does anyone else get a problem with Windows 7 clients prompting for the radius credentials 2 or 3 times before finally accepting them? No errors are shown on the radius side, and I've read that this is a problem with the operating system, but wondered whether anyone in this knowledgeable community had overcome this? Cheers, Andi ________________________________
From 1st November 2011 UWIC changed its title to Cardiff Metropolitan University. From the 6th December 2011, as part of this change, all email addresses which included @uwic.ac.uk have changed to @cardiffmet.ac.uk. All emails sent from Cardiff Metropolitan University will now be sent from the new @cardiffmet.ac.uk address. Please could you ensure that all of your contact records and databases are updated to reflect this change. Further information can be found on the website here.<http://www3.uwic.ac.uk/English/News/Pages/UWIC-Name-Change.aspx>
Hi,
Does anyone else get a problem with Windows 7 clients prompting for the radius credentials 2 or 3 times before finally accepting them? No errors are shown on the radius side, and I’ve read that this is a problem with the operating system, but wondered whether anyone in this knowledgeable community had overcome this?
have you tried the pre-caching option where you can provide the details in advance? (windows 7 options in advanced EAP settings) alan
I've seen such things if the authentication takes an extraordinary length of time. Windows EAP client expects a round trip on the order of 30 seconds (or 60, ummm my memory is already fading...) and if EAP doesn't come back in that time, could abort the authentication. Typically another will start right away. This can be exacerbated by Cisco APs that use the Session-Timeout value to kill the session rather than retransmit. The orginal response will often be accepted when it arrives late. Their is a caching option in the supplicant (Remember my credentials checkbox something like that) that can make some of this transparent. Why do I know? My SecurID EAP client had to stand on it's head and dance around these constraints. Dave. (not there anymore) Quoting Alan Buxey <A.L.M.Buxey@lboro.ac.uk>:
Hi,
Does anyone else get a problem with Windows 7 clients prompting for the radius credentials 2 or 3 times before finally accepting them? No errors are shown on the radius side, and I’ve read that this is a problem with the operating system, but wondered whether anyone in this knowledgeable community had overcome this?
have you tried the pre-caching option where you can provide the details in advance? (windows 7 options in advanced EAP settings)
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 05/03/12 16:16, Morris, Andi wrote:
Hi all,
Apologies for being slightly off topic.
Does anyone else get a problem with Windows 7 clients prompting for the radius credentials 2 or 3 times before finally accepting them? No errors are shown on the radius side, and I’ve read that this is a problem with the operating system, but wondered whether anyone in this knowledgeable community had overcome this?
We don't see that, and I've never heard that explanation.
Hi,
On 05/03/12 16:16, Morris, Andi wrote:
Hi all,
Apologies for being slightly off topic.
Does anyone else get a problem with Windows 7 clients prompting for the radius credentials 2 or 3 times before finally accepting them? No errors are shown on the radius side, and I’ve read that this is a problem with the operating system, but wondered whether anyone in this knowledgeable community had overcome this?
We don't see that, and I've never heard that explanation.
wait until you're running windows 8 - where you'll be flicking backwards and forwards between the new 'metro' interface and the real win7 interface that still lurks underneath doing all the real things (in some form of 'not really in the right place limbo' with far too many clicks/swipes)....until you finally give up on whether credentials work or not and cower in a corner crying yourself to sleep wishing things just worked like they used to and why cant you just have an ethernet cable ;-) alan
On Mon, Mar 05, 2012 at 05:36:24PM +0000, Phil Mayers wrote:
On 05/03/12 16:16, Morris, Andi wrote:
Does anyone else get a problem with Windows 7 clients prompting for the radius credentials 2 or 3 times before finally accepting them? No errors are shown on the radius side, and I’ve read that this is a problem with the operating system, but wondered whether anyone in this knowledgeable community had overcome this?
We don't see that, and I've never heard that explanation.
I've seen it here as well. It seems a lot worse (no hard evidence though) on XP, and also on Vista. Have seen it on 7, but less often. Still haven't managed to work out what's causing it. I think for XP (sp3) it's just ancient wireless support as we see other wireless problems using that. Apart from that it could be either Windows or the Cisco network kit. It could be clients with a weak wireless signal, but I've also seen it sitting close within the range of several APs. I don't believe there are any problems with FreeRADIUS at all. Caching passwords gets around the problem generally speaking, but we try not to encourage that for obvious reasons (except that 99% of phones/handhelds do it anyway, so may be less of a reason to worry about it now). It would be nice if Windows cached the credentials long enough to type them in again two seconds later, though, although I'm not sure it's because it thinks the password is wrong, or because something failed. We've not managed to get anything useful out of any windows trace files, that we could see. Unfortunately it's not easily repeatable. Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Architect (UNIX and Networks), Network Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
I'm currently testing this on a wired network, so signal definitely isn't the issue. I also don't think that this is an issue with freeradius, but I figured this mailing list would be full of people who may have seen this before and have resolved it. Andi -----Original Message----- From: freeradius-users-bounces+amorris=cardiffmet.ac.uk@lists.freeradius.org [mailto:freeradius-users-bounces+amorris=cardiffmet.ac.uk@lists.freeradius.org] On Behalf Of Matthew Newton Sent: 06 March 2012 14:29 To: FreeRadius users mailing list Subject: Re: Windows 7 prompting several times On Mon, Mar 05, 2012 at 05:36:24PM +0000, Phil Mayers wrote:
On 05/03/12 16:16, Morris, Andi wrote:
Does anyone else get a problem with Windows 7 clients prompting for the radius credentials 2 or 3 times before finally accepting them? No errors are shown on the radius side, and I’ve read that this is a problem with the operating system, but wondered whether anyone in this knowledgeable community had overcome this?
We don't see that, and I've never heard that explanation.
I've seen it here as well. It seems a lot worse (no hard evidence though) on XP, and also on Vista. Have seen it on 7, but less often. Still haven't managed to work out what's causing it. I think for XP (sp3) it's just ancient wireless support as we see other wireless problems using that. Apart from that it could be either Windows or the Cisco network kit. It could be clients with a weak wireless signal, but I've also seen it sitting close within the range of several APs. I don't believe there are any problems with FreeRADIUS at all. Caching passwords gets around the problem generally speaking, but we try not to encourage that for obvious reasons (except that 99% of phones/handhelds do it anyway, so may be less of a reason to worry about it now). It would be nice if Windows cached the credentials long enough to type them in again two seconds later, though, although I'm not sure it's because it thinks the password is wrong, or because something failed. We've not managed to get anything useful out of any windows trace files, that we could see. Unfortunately it's not easily repeatable. Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Architect (UNIX and Networks), Network Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk> - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ________________________________ From 1st November 2011 UWIC changed its title to Cardiff Metropolitan University. From the 6th December 2011, as part of this change, all email addresses which included @uwic.ac.uk have changed to @cardiffmet.ac.uk. All emails sent from Cardiff Metropolitan University will now be sent from the new @cardiffmet.ac.uk address. Please could you ensure that all of your contact records and databases are updated to reflect this change. Further information can be found on the website here.<http://www3.uwic.ac.uk/English/News/Pages/UWIC-Name-Change.aspx> Ar Dachwedd y 1af 2011 newidiodd UWIC ei henw i Brifysgol Fetropolitan Caerdydd. O Ragfyr 6ed, fel rhan o'r newid yma, bydd pob cyfeiriad e-bost sy'n cynnwys @uwic.ac.uk yn newid i @cardiffmet.ac.uk. Bydd yr holl ebyst a ddanfonir o Brifysgol Fetropolitan Caerdydd yn cael eu danfon o‘r cyfeiriad @cardiffmet.ac.uk newydd. Gwnewch yn siwr eich bod yn diweddaru eich cofnodion cyswllt a'ch cronfeydd data i adlewyrchu hyn. Gellir cael rhagor o wybodaeth ar y wefan yma.<http://www3.uwic.ac.uk/English/News/Pages/UWIC-Name-Change.aspx>
Hi Andi, I did see the behavior, and it appears to be a bug with the windows supplicant. Apparently, the credentials are not even passed to the EAP module to initiate the session with the NAS... We do not have any kind of contact at Microsoft to open a bug, so I believe you are stuck with those issues :S On 12-03-05 11:16 AM, Morris, Andi wrote:
Hi all,
Apologies for being slightly off topic.
Does anyone else get a problem with Windows 7 clients prompting for the radius credentials 2 or 3 times before finally accepting them? No errors are shown on the radius side, and I’ve read that this is a problem with the operating system, but wondered whether anyone in this knowledgeable community had overcome this?
Cheers,
Andi
------------------------------------------------------------------------
From 1st November 2011 UWIC changed its title to Cardiff Metropolitan University. From the 6th December 2011, as part of this change, all email addresses which included @uwic.ac.uk have changed to @cardiffmet.ac.uk. All emails sent from Cardiff Metropolitan University will now be sent from the new @cardiffmet.ac.uk address. *Please could you ensure that all of your contact records and databases are updated to reflect this change.* Further information can be found on the website here. <http://www3.uwic.ac.uk/English/News/Pages/UWIC-Name-Change.aspx>
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Francois Gaudreault, ing. jr fgaudreault@inverse.ca :: +1.514.447.4918 (x130) :: www.inverse.ca Inverse inc. :: Leaders behind SOGo (www.sogo.nu) and PacketFence (www.packetfence.org)
Hi, I am Ricardo and i am also having the same problem. Is there any solution for this problem? Best Regards Ricardo -- View this message in context: http://freeradius.1045715.n5.nabble.com/Windows-7-prompting-several-times-tp... Sent from the FreeRadius - User mailing list archive at Nabble.com.
Hi Ricardo, I am still yet to find a solution, however I have sent logs to Microsoft as they requested and they suggested that the problem was with the Cisco switch asking for the credentials several times, rather than it being the Windows supplicant, or freeradius being the problem. Are you using Cisco hardware by any chance? Cheers, Andi -----Original Message----- From: freeradius-users-bounces+amorris=cardiffmet.ac.uk@lists.freeradius.org [mailto:freeradius-users-bounces+amorris=cardiffmet.ac.uk@lists.freeradius.org] On Behalf Of Ricardo89 Sent: 29 March 2012 10:49 To: freeradius-users@lists.freeradius.org Subject: Re: Windows 7 prompting several times Hi, I am Ricardo and i am also having the same problem. Is there any solution for this problem? Best Regards Ricardo -- View this message in context: http://freeradius.1045715.n5.nabble.com/Windows-7-prompting-several-times-tp... Sent from the FreeRadius - User mailing list archive at Nabble.com. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ________________________________ From 1st November 2011 UWIC changed its title to Cardiff Metropolitan University. From the 6th December 2011, as part of this change, all email addresses which included @uwic.ac.uk have changed to @cardiffmet.ac.uk. All emails sent from Cardiff Metropolitan University will now be sent from the new @cardiffmet.ac.uk address. Please could you ensure that all of your contact records and databases are updated to reflect this change. Further information can be found on the website here.<http://www3.uwic.ac.uk/English/News/Pages/UWIC-Name-Change.aspx> Ar Dachwedd y 1af 2011 newidiodd UWIC ei henw i Brifysgol Fetropolitan Caerdydd. O Ragfyr 6ed, fel rhan o'r newid yma, bydd pob cyfeiriad e-bost sy'n cynnwys @uwic.ac.uk yn newid i @cardiffmet.ac.uk. Bydd yr holl ebyst a ddanfonir o Brifysgol Fetropolitan Caerdydd yn cael eu danfon o‘r cyfeiriad @cardiffmet.ac.uk newydd. Gwnewch yn siwr eich bod yn diweddaru eich cofnodion cyswllt a'ch cronfeydd data i adlewyrchu hyn. Gellir cael rhagor o wybodaeth ar y wefan yma.<http://www3.uwic.ac.uk/English/News/Pages/UWIC-Name-Change.aspx>
Hi Andy, and thanks for your early reply. Our wireless infrastructure is 3com. When we noticed this issue, and to discard the possibility of being a problem of the hardware, we tested with a Linksys/cisco wireless access point and the issue persisted. In order to understand the problem, we installed a windows server 2003 and the internet authentication server to test if the problem would be from the freeradius. Then we discovered that must be some kind of difference between the messages exchanged between a windows supplicant and a freeradius server and a windows supplicant and a windows server 2003 running the internet authentication server, because in the first case, when the password was wrong the windows supplicant don't show us a message saying that the password was wrong, simple asks for entering the password again and again. In the second using the windows 2003 server and the internet authentication server, when a wrong password was entered, the supplicant show a message stating that the password was wrong. Then we configured the internet authentication server to act as proxy, in order to redirect the all the requests to our Linux freeradius server, and the issue persisted. Then we decided to set up our windows server 2003 and internet authentication server to work as radius server and until now the issue seems to disappear. With these tests, it seems that messages exchanged between a windows supplicant and Linux radius server and windows supplicant and windows 2003 with the internet authentication server are different in some kind, and we like to understand why in the case of a Linux radius server the user must enter the credentials more than one time. Best regards Ricardo -- View this message in context: http://freeradius.1045715.n5.nabble.com/Windows-7-prompting-several-times-tp... Sent from the FreeRadius - User mailing list archive at Nabble.com.
Hi,
freeradius. Then we discovered that must be some kind of difference between the messages exchanged between a windows supplicant and a freeradius server and a windows supplicant and a windows server 2003 running the internet authentication server, because in the first case, when the password was wrong the windows supplicant don't show us a message saying that the password was wrong, simple asks for entering the password again and again. In the second using the windows 2003 server and the internet authentication server, when a wrong password was entered, the supplicant show a message stating that the password was wrong.
well, configure your FreeRADIUS to send the 'your passwords was wrong, retry' message.....this is on by default in Windows servers as its Microsoft stuff. you will need to look at the bottom of eap.conf and bottom of mschap module the FreeRADIUS server does what you tell it to do oh, you'll need to be running FR 2.1.11 or higher alan
Hi, On 29.03.2012 14:07, Alan Buxey wrote:
well, configure your FreeRADIUS to send the 'your passwords was wrong, retry' message.....this is on by default in Windows servers as its Microsoft stuff.
[..] oh, you'll need to be running FR 2.1.11 or higher
oh, good to know this. I just looked in the source of 2.1.11 and found send_error + comments. I've seen this problem in action several times - every time we need to support our clients manually :( The problem is: debian ist still using the version 2.1.10 - even in sid... Is there a way to get this backported in the old version? -- Jens Weibler IT-Services Hochschule Darmstadt www.h-da.de University of Applied Sciences Fachbereich Informatik www.fbi.h-da.de Schöfferstr. 8b D-64295 Darmstadt Tel +49 6151 16-8425 Fax +49 6151 16-8935 jens.weibler@h-da.de
Hi Alan, thanks for your reply. We are running freeradius 2.1.10, and therefore we need to update our radius version that we will gladly do. Will this update solve the initial issue of sometimes, a user needs to enter his credentials more than one time before the server accepted them? Best Regards Ricardo -- View this message in context: http://freeradius.1045715.n5.nabble.com/Windows-7-prompting-several-times-tp... Sent from the FreeRadius - User mailing list archive at Nabble.com.
Hi,
We are running freeradius 2.1.10, and therefore we need to update our radius version that we will gladly do. Will this update solve the initial issue of sometimes, a user needs to enter his credentials more than one time before the server accepted them?
<shrug> I dont know your setup...i dont know what auth you are doing, what your default EAP method is etc. it works here - we've been running 802.1X in production with FreeRADIUS since a long long time. alan
Hi Alan, thanks for your reply. Until so far, seems like the update for the last version reduce the number of occurrences of the problem which is that sometimes users in windows 7 entered their correct credentials, but that credentials doesn’t reached the server, therefore the user was asked to entered again and again their credentials, normally at third time the credentials reached the freeradius server, but in some cases neither the tenth time the credentials reach the server. During the rest of day and tomorrow I and my team will conduct more tests to check if the problem is finally resolved. I like to thank you and Andi for the help that you gave me. Best Regards Ricardo Cardoso -- View this message in context: http://freeradius.1045715.n5.nabble.com/Windows-7-prompting-several-times-tp... Sent from the FreeRadius - User mailing list archive at Nabble.com.
Hi Ricardo, I will be very interested in your findings should you resolve this. I stopped looking down the freeradius route for this particular problem as I found it was also happening on a network that we authenticate using Microsoft IAS, but still using Cisco hardware, therefore ruling out freeradius and indicating either the supplicant or the Cisco switches. Cheers, Andi -----Original Message----- From: freeradius-users-bounces+amorris=cardiffmet.ac.uk@lists.freeradius.org [mailto:freeradius-users-bounces+amorris=cardiffmet.ac.uk@lists.freeradius.org] On Behalf Of Ricardo89 Sent: 29 March 2012 16:49 To: freeradius-users@lists.freeradius.org Subject: Re: Windows 7 prompting several times Hi Alan, thanks for your reply. Until so far, seems like the update for the last version reduce the number of occurrences of the problem which is that sometimes users in windows 7 entered their correct credentials, but that credentials doesn’t reached the server, therefore the user was asked to entered again and again their credentials, normally at third time the credentials reached the freeradius server, but in some cases neither the tenth time the credentials reach the server. During the rest of day and tomorrow I and my team will conduct more tests to check if the problem is finally resolved. I like to thank you and Andi for the help that you gave me. Best Regards Ricardo Cardoso -- View this message in context: http://freeradius.1045715.n5.nabble.com/Windows-7-prompting-several-times-tp... Sent from the FreeRadius - User mailing list archive at Nabble.com. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ________________________________ From 1st November 2011 UWIC changed its title to Cardiff Metropolitan University. From the 6th December 2011, as part of this change, all email addresses which included @uwic.ac.uk have changed to @cardiffmet.ac.uk. All emails sent from Cardiff Metropolitan University will now be sent from the new @cardiffmet.ac.uk address. Please could you ensure that all of your contact records and databases are updated to reflect this change. Further information can be found on the website here.<http://www3.uwic.ac.uk/English/News/Pages/UWIC-Name-Change.aspx> Ar Dachwedd y 1af 2011 newidiodd UWIC ei henw i Brifysgol Fetropolitan Caerdydd. O Ragfyr 6ed, fel rhan o'r newid yma, bydd pob cyfeiriad e-bost sy'n cynnwys @uwic.ac.uk yn newid i @cardiffmet.ac.uk. Bydd yr holl ebyst a ddanfonir o Brifysgol Fetropolitan Caerdydd yn cael eu danfon o‘r cyfeiriad @cardiffmet.ac.uk newydd. Gwnewch yn siwr eich bod yn diweddaru eich cofnodion cyswllt a'ch cronfeydd data i adlewyrchu hyn. Gellir cael rhagor o wybodaeth ar y wefan yma.<http://www3.uwic.ac.uk/English/News/Pages/UWIC-Name-Change.aspx>
Hi again Alan. For the record my authentication mechanism is Ldap and the EAP type is EAP-PEAP with MSCHAP v2. Best regards Ricardo Cardoso -- View this message in context: http://freeradius.1045715.n5.nabble.com/Windows-7-prompting-several-times-tp... Sent from the FreeRadius - User mailing list archive at Nabble.com.
Hi,
For the record my authentication mechanism is Ldap and the EAP type is EAP-PEAP with MSCHAP v2.
okay , is 'peap' set as the default EAP type at top of eap.conf (to remove a couple of packets...the NAK ) is your ldap auth in inner-tunnel protected from all EAP stuff going on ....or do you see each request hitting your LDAP server 3 or 4 times? how fast can your LDAP respond - this would be a bottleneck. alan
Hi Andi. Can you tell me which version of freeradius on your server? Here when I use Internet Authentication Server the problem occurs less times than when a I used the obsolete version of freeradius. Now that i update my freeradius to version 2.11.12 the problem occurrences apparently reduced. But I only can assure it when i ran more tests. Best Regards Ricardo Cardoso -- View this message in context: http://freeradius.1045715.n5.nabble.com/Windows-7-prompting-several-times-tp... Sent from the FreeRadius - User mailing list archive at Nabble.com.
Hi Alan, thanks for your reply. Yes Alan, I see each request request hitting my LDAP server at least three times. When that problem of the user needs to enter their credentials more than one time, as I said in the previous post nothing gets to the Ldap server, in the best cases only at the third time the credentials reach the Ldap server and also I see that request hitting the Ldap three times. Do you know the solution for this? Best Regards, Ricardo -- View this message in context: http://freeradius.1045715.n5.nabble.com/Windows-7-prompting-several-times-tp... Sent from the FreeRadius - User mailing list archive at Nabble.com.
Ricardo89 wrote:
Yes Alan, I see each request request hitting my LDAP server at least three times.
So... run the server in debug mode to see WHY it's hitting the LDAP server three times. Then, look at the debug log, and change the LDAP queries so that it only hits the LDAP server once. There is no magic here. You have to understand the solution you built. Alan DeKok.
Hi,
Do you know the solution for this?
if the request doesnt get to the server. then as others have said, this is no RADIUS problem - this is something wrong elsewhere in the network. now, could be an issue with the AP communication...could be a L2 issue, a L3 issue, could be a bug in the AP firmware or a problem in the AP config. for example, are these APs on a switch thats having to recalculate spanning-tree on its links or upstream neighbour? if you put a PC onto that AP port with same IP settings , whats it connectivity to the RADIUS server like (use eg smokeping) . you are currently dealing with an issue that is beyond the scope of this list alan
Hi Alan DeKok, thanks for your reply. I think you don’t understand what my problem is. My main problem is to understand why when the user is asked to enter his credentials more than one time nothing reaches my freeradius server, the only communication requests remains between the Access Point and the supplicant. In one of the many tests that I made, I was checking the logs when the user was entering his credentials and nothing shows up in the logs only on the third or fourth attempt finally I see the connection accept logs. Best Regards Ricardo -- View this message in context: http://freeradius.1045715.n5.nabble.com/Windows-7-prompting-several-times-tp... Sent from the FreeRadius - User mailing list archive at Nabble.com.
This ties in with what I was saying, that the NAS (switch/access point) is asking the supplicant for the password several times, before finally receiving the user's entry and sending it onto the radius to be accepted or denied, whichever the case may be. I still think the problem is supplicant/NAS. Cheers, Andi -----Original Message----- From: freeradius-users-bounces+amorris=cardiffmet.ac.uk@lists.freeradius.org [mailto:freeradius-users-bounces+amorris=cardiffmet.ac.uk@lists.freeradius.org] On Behalf Of Ricardo89 Sent: 30 March 2012 10:48 To: freeradius-users@lists.freeradius.org Subject: Re: Windows 7 prompting several times Hi Alan DeKok, thanks for your reply. I think you don’t understand what my problem is. My main problem is to understand why when the user is asked to enter his credentials more than one time nothing reaches my freeradius server, the only communication requests remains between the Access Point and the supplicant. In one of the many tests that I made, I was checking the logs when the user was entering his credentials and nothing shows up in the logs only on the third or fourth attempt finally I see the connection accept logs. Best Regards Ricardo -- View this message in context: http://freeradius.1045715.n5.nabble.com/Windows-7-prompting-several-times-tp... Sent from the FreeRadius - User mailing list archive at Nabble.com. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ________________________________ From 1st November 2011 UWIC changed its title to Cardiff Metropolitan University. From the 6th December 2011, as part of this change, all email addresses which included @uwic.ac.uk have changed to @cardiffmet.ac.uk. All emails sent from Cardiff Metropolitan University will now be sent from the new @cardiffmet.ac.uk address. Please could you ensure that all of your contact records and databases are updated to reflect this change. Further information can be found on the website here.<http://www3.uwic.ac.uk/English/News/Pages/UWIC-Name-Change.aspx> Ar Dachwedd y 1af 2011 newidiodd UWIC ei henw i Brifysgol Fetropolitan Caerdydd. O Ragfyr 6ed, fel rhan o'r newid yma, bydd pob cyfeiriad e-bost sy'n cynnwys @uwic.ac.uk yn newid i @cardiffmet.ac.uk. Bydd yr holl ebyst a ddanfonir o Brifysgol Fetropolitan Caerdydd yn cael eu danfon o‘r cyfeiriad @cardiffmet.ac.uk newydd. Gwnewch yn siwr eich bod yn diweddaru eich cofnodion cyswllt a'ch cronfeydd data i adlewyrchu hyn. Gellir cael rhagor o wybodaeth ar y wefan yma.<http://www3.uwic.ac.uk/English/News/Pages/UWIC-Name-Change.aspx>
Ricardo89 wrote:
I think you don’t understand what my problem is.
I answered the question you asked, using the message you sent. If you're not describing the real problem, then you're wasting my time.
My main problem is to understand why when the user is asked to enter his credentials more than one time nothing reaches my freeradius server, the only communication requests remains between the Access Point and the supplicant.
Then buy an access point that works. The AP isn't sending RADIUS packets. This isn't a RADIUS problem. Alan DeKok.
Hi Andy, thanks for the brief reply. I also think that the problem is that the NAS is asking the supplicant for the password several times, before finally receiving the user's entry and sending to radius. I would like to solve the problem but since nobody yet find an answer. I don't know what to do next. Best Regards Ricardo -- View this message in context: http://freeradius.1045715.n5.nabble.com/Windows-7-prompting-several-times-tp... Sent from the FreeRadius - User mailing list archive at Nabble.com.
Hi Ricardo, Sorry it was a brief answer but I'm also unsure of where to turn next with this, especially as you are seeing the same issue with different network hardware. Cheers, Andi -----Original Message----- From: freeradius-users-bounces+amorris=cardiffmet.ac.uk@lists.freeradius.org [mailto:freeradius-users-bounces+amorris=cardiffmet.ac.uk@lists.freeradius.org] On Behalf Of Ricardo89 Sent: 30 March 2012 11:45 To: freeradius-users@lists.freeradius.org Subject: Re: Windows 7 prompting several times Hi Andy, thanks for the brief reply. I also think that the problem is that the NAS is asking the supplicant for the password several times, before finally receiving the user's entry and sending to radius. I would like to solve the problem but since nobody yet find an answer. I don't know what to do next. Best Regards Ricardo -- View this message in context: http://freeradius.1045715.n5.nabble.com/Windows-7-prompting-several-times-tp... Sent from the FreeRadius - User mailing list archive at Nabble.com. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ________________________________ From 1st November 2011 UWIC changed its title to Cardiff Metropolitan University. From the 6th December 2011, as part of this change, all email addresses which included @uwic.ac.uk have changed to @cardiffmet.ac.uk. All emails sent from Cardiff Metropolitan University will now be sent from the new @cardiffmet.ac.uk address. Please could you ensure that all of your contact records and databases are updated to reflect this change. Further information can be found on the website here.<http://www3.uwic.ac.uk/English/News/Pages/UWIC-Name-Change.aspx> Ar Dachwedd y 1af 2011 newidiodd UWIC ei henw i Brifysgol Fetropolitan Caerdydd. O Ragfyr 6ed, fel rhan o'r newid yma, bydd pob cyfeiriad e-bost sy'n cynnwys @uwic.ac.uk yn newid i @cardiffmet.ac.uk. Bydd yr holl ebyst a ddanfonir o Brifysgol Fetropolitan Caerdydd yn cael eu danfon o‘r cyfeiriad @cardiffmet.ac.uk newydd. Gwnewch yn siwr eich bod yn diweddaru eich cofnodion cyswllt a'ch cronfeydd data i adlewyrchu hyn. Gellir cael rhagor o wybodaeth ar y wefan yma.<http://www3.uwic.ac.uk/English/News/Pages/UWIC-Name-Change.aspx>
On 30/03/12 11:58, Morris, Andi wrote:
Hi Ricardo, Sorry it was a brief answer but I'm also unsure of where to turn next with this, especially as you are seeing the same issue with different network hardware.
Well, you guys need to debug your network hardware (and Ricardo needs to use a threaded email client!) It's not a FreeRADIUS issue if no packets are arriving at FreeRADIUS. Some possible things to consider: 1. Some wireless platforms have a feature where they will try to "nudge" clients onto either a different access point, or 5GHz rather than 2.4GHz. This might be implemented using vendor extensions (CCX) or it might be implemented by simply "rejecting" the client. Some clients treat a number of successive rejections as "bad password", because they can't distinguish between radio-layer and eap-layer rejections. On Cisco lightweight, this feature tends to interop badly with e.g. Linux clients, using the default values. 2. Some wireless platforms vertically integrate the whole protocol stack (radio, eap, arp/dhcp/ip, etc.) and will reject clients at the bottom-most layer for violations at upper layers. This can confuse clients, and make them think auth has "failed" 3. Interference can cause dropped EAP packets. Check your EAP timeout values, and look for radio-layer problems. Get a decent wireless test tool - the Fluke AirCheck is excellent, and allows you to force auth to a specific BSSID/SSID combination, so you can track problems down. ...and so on. No-one said wireless was easy. But this is not a FreeRADIUS problem.
Hi,
thanks for the brief reply. I also think that the problem is that the NAS is asking the supplicant for the password several times, before finally receiving the user's entry and sending to radius. I would like to solve the problem but since nobody yet find an answer. I don't know what to do next.
turn on full AAA debugging on the NAS ? alan
Hi Alan, thanks for your support. Finally I have my freeradius server working fine, but there are a new issue with the windows clients. If a windows client first enter his credentials erroneous the Ferraris send a error message, next if the user enter the correct credentials the radius server doesn't authenticate the client. Checking the source code, in the file run_eap_mschapv2, when the client sends the correct password after sending the wrong ones i could check the windows sends a message with the code PW_EAP_MSCHAPV2_FAILURE instead of a PW_EAP_MSCHAPV2_CHALLENGE. I detect that the error was in that file because in the with the message "rlm_eap_mschapv2:Unexpected response received" i also print the value of the data->code and it was 4 that matches with PW_EAP_MSCHAPV2_FAILURE. Can you help me? -- View this message in context: http://freeradius.1045715.n5.nabble.com/Windows-7-prompting-several-times-tp... Sent from the FreeRadius - User mailing list archive at Nabble.com.
Ricardo89 wrote:
If a windows client first enter his credentials erroneous the Ferraris send a error message, next if the user enter the correct credentials the radius server doesn't authenticate the client.
No.
Checking the source code, in the file run_eap_mschapv2, when the client sends the correct password after sending the wrong ones i could check the windows sends a message with the code PW_EAP_MSCHAPV2_FAILURE instead of a PW_EAP_MSCHAPV2_CHALLENGE.
So... the Windows box sending a failure means you conclude that FreeRADIUS is at fault?
I detect that the error was in that file because in the with the message "rlm_eap_mschapv2:Unexpected response received" i also print the value of the data->code and it was 4 that matches with PW_EAP_MSCHAPV2_FAILURE. Can you help me?
That message is sent by the Windows box to FreeRADIUS. It says that the Windows box didn't like the response from FreeRADIUS. i.e. the Windows box is caching the *wrong* password. Go fix it. Ask Microsoft how this is done. Alan DeKok.
Quoting Alan DeKok <aland@deployingradius.com>:
... i.e. the Windows box is caching the *wrong* password.
Go fix it. Ask Microsoft how this is done.
In Windows 7, connection setup, there is a check box for remembering credentials, clear it. That gives you some manual control over what has previously been an automated process. The follow KB indicates how you can clear cached EAP credentials on XP. The same registry entries exist on Win7 in a different place (I forgot exactly where) because of the migration to the new EAPhost implementation. http://support.microsoft.com/kb/823731 Also; if a connection is flagged for use by all users on a system, the key is in HKLM, not the current user. Dave.
Hello. I've been following the this tread for quite a while. I also had this problem of windows 7 prompting for credential several times without showning any error message. The problem was gone once i updated 2.1.10(debian) to 2.1.12. Now, if the user enters wrong credentials, windows prompts for credentials again with a message stating that the user credentials are invalid. The problem is that if the user now types the correct credential, the access will still be denied. After the third retry, windows gives up on asking and the user must click on the wireless network icon, to start the login process again. As Alan said, this seemed like windows was caching the bad credentials. But, the logs states a different message. After the first "access denied", each retry comes with a "rlm_eap_mschapv2:Unexpected response received". Im not saying there's a freeradius fault, it can be windows fault or just windows not following the RFC(wouldnt be the first time). I've also looked at the code, to try to figure out what was happening. At rlm_eap_mschapv2.c (line 444): case PW_EAP_MSCHAPV2_RESPONSE: if (data->code != PW_EAP_MSCHAPV2_CHALLENGE) { radlog(L_ERR, "rlm_eap_mschapv2: Unexpected response received"); return 0; } the if clause is reached having data->code = PW_EAP_MSCHAPV2_FAILURE. Aparently windows is sending a EAP-Response/MSCHAP_Failure where it should send a EAP-Failure/MSCHAP_Failure (to acknowlage the previous sent EAP-Request/Failure, acording to RFC 'Appendix A - Examples') Or Should send a EAP-Response/MSCHAP_Response since it is actually retrying the authentication. One possibility is that the new "send_error" option is missleading windows. According to RFC 'Appendix A - Examples', a "retry" flag in order to tell windows to try again. Since my knowledge of the freeradius souce code is very basic, i couldnt figure out exactly if this is happening. Thanks Jaime -- View this message in context: http://freeradius.1045715.n5.nabble.com/Windows-7-prompting-several-times-tp... Sent from the FreeRadius - User mailing list archive at Nabble.com.
jaimeventura wrote:
Now, if the user enters wrong credentials, windows prompts for credentials again with a message stating that the user credentials are invalid. The problem is that if the user now types the correct credential, the access will still be denied. After the third retry, windows gives up on asking and the user must click on the wireless network icon, to start the login process again.
See the ChangeLog for 2.1.11: * Make retry and error message configurable in mschap. See raddb/modules/mschap * Allow EAP-MSCHAPv2 to send error message to client. This change allows some clients to prompt the user for a new password. See raddb/eap.conf, mschapv2 section, "send_error".
As Alan said, this seemed like windows was caching the bad credentials. But, the logs states a different message. After the first "access denied", each retry comes with a "rlm_eap_mschapv2:Unexpected response received". Im not saying there's a freeradius fault, it can be windows fault or just windows not following the RFC(wouldnt be the first time).
I already said who to blame: That failure message is being sent by the Windows machine. FreeRADIUS just logs it. Don't blame the messenger.
Aparently windows is sending a EAP-Response/MSCHAP_Failure where it should send a EAP-Failure/MSCHAP_Failure (to acknowlage the previous sent EAP-Request/Failure, acording to RFC 'Appendix A - Examples')
Yes.
Or Should send a EAP-Response/MSCHAP_Response since it is actually retrying the authentication.
Possibly.
One possibility is that the new "send_error" option is missleading windows. According to RFC 'Appendix A - Examples', a "retry" flag in order to tell windows to try again.
FreeRADIUS sets the retry flag.
Since my knowledge of the freeradius souce code is very basic, i couldnt figure out exactly if this is happening.
You're wasting your time by looking at FreeRADIUS. The Windows box is prompting multiple times for the password. This is because the *WINDOWS BOX* is prompting multiple times for the password. It has nothing to do with FreeRADIUS. No amount of poking FreeRADIUS will fix it. Alan DeKok.
Apologies for keeping this going on the freeradius list when it is nothing to do with it, but has anyone seen this behaviour on anything but a Windows supplicant? I'm trying to debug whether it's a supplicant or NAS issue. As Alan has said, this is not a freeradius issue. I see the same symptoms on another network that we have, which uses Microsoft IAS. The only common ground is the OS and the Cisco authenticator (three different models: catalyst 2950, WLC4400 and WLC5500). Microsoft have analysed trace logs I have given them and pointed the finger at the NAS, but as I only see this on Windows supplicants I'm not so sure. If there is a more appropriate list to move this to then I will happily oblige to avoid the noise on the FR list. Cheers, Andi -----Original Message----- From: freeradius-users-bounces+amorris=cardiffmet.ac.uk@lists.freeradius.org [mailto:freeradius-users-bounces+amorris=cardiffmet.ac.uk@lists.freeradius.org] On Behalf Of Alan DeKok Sent: 03 April 2012 16:28 To: FreeRadius users mailing list Subject: Re: Windows 7 prompting several times jaimeventura wrote:
Now, if the user enters wrong credentials, windows prompts for credentials again with a message stating that the user credentials are invalid. The problem is that if the user now types the correct credential, the access will still be denied. After the third retry, windows gives up on asking and the user must click on the wireless network icon, to start the login process again.
See the ChangeLog for 2.1.11: * Make retry and error message configurable in mschap. See raddb/modules/mschap * Allow EAP-MSCHAPv2 to send error message to client. This change allows some clients to prompt the user for a new password. See raddb/eap.conf, mschapv2 section, "send_error".
As Alan said, this seemed like windows was caching the bad credentials. But, the logs states a different message. After the first "access denied", each retry comes with a "rlm_eap_mschapv2:Unexpected response received". Im not saying there's a freeradius fault, it can be windows fault or just windows not following the RFC(wouldnt be the first time).
I already said who to blame: That failure message is being sent by the Windows machine. FreeRADIUS just logs it. Don't blame the messenger.
Aparently windows is sending a EAP-Response/MSCHAP_Failure where it should send a EAP-Failure/MSCHAP_Failure (to acknowlage the previous sent EAP-Request/Failure, acording to RFC 'Appendix A - Examples')
Yes.
Or Should send a EAP-Response/MSCHAP_Response since it is actually retrying the authentication.
Possibly.
One possibility is that the new "send_error" option is missleading windows. According to RFC 'Appendix A - Examples', a "retry" flag in order to tell windows to try again.
FreeRADIUS sets the retry flag.
Since my knowledge of the freeradius souce code is very basic, i couldnt figure out exactly if this is happening.
You're wasting your time by looking at FreeRADIUS. The Windows box is prompting multiple times for the password. This is because the *WINDOWS BOX* is prompting multiple times for the password. It has nothing to do with FreeRADIUS. No amount of poking FreeRADIUS will fix it. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ________________________________ From 1st November 2011 UWIC changed its title to Cardiff Metropolitan University. From the 6th December 2011, as part of this change, all email addresses which included @uwic.ac.uk have changed to @cardiffmet.ac.uk. All emails sent from Cardiff Metropolitan University will now be sent from the new @cardiffmet.ac.uk address. Please could you ensure that all of your contact records and databases are updated to reflect this change. Further information can be found on the website here.<http://www3.uwic.ac.uk/English/News/Pages/UWIC-Name-Change.aspx> Ar Dachwedd y 1af 2011 newidiodd UWIC ei henw i Brifysgol Fetropolitan Caerdydd. O Ragfyr 6ed, fel rhan o'r newid yma, bydd pob cyfeiriad e-bost sy'n cynnwys @uwic.ac.uk yn newid i @cardiffmet.ac.uk. Bydd yr holl ebyst a ddanfonir o Brifysgol Fetropolitan Caerdydd yn cael eu danfon o‘r cyfeiriad @cardiffmet.ac.uk newydd. Gwnewch yn siwr eich bod yn diweddaru eich cofnodion cyswllt a'ch cronfeydd data i adlewyrchu hyn. Gellir cael rhagor o wybodaeth ar y wefan yma.<http://www3.uwic.ac.uk/English/News/Pages/UWIC-Name-Change.aspx>
Just to update anyone else with this issue, we have found the cause of the problem on our network was indeed the Cisco config. On our wireless controller we used the command below and the re-request no longer appears. I'm still playing with the timeouts for the catalyst switches for the correct timeout for these, but at least we know definitively where the problem lay. config advanced eap identity-request-timeout 15 Cheers, Andi -----Original Message----- From: freeradius-users-bounces+amorris=cardiffmet.ac.uk@lists.freeradius.org [mailto:freeradius-users-bounces+amorris=cardiffmet.ac.uk@lists.freeradius.org] On Behalf Of Morris, Andi Sent: 03 April 2012 16:46 To: FreeRadius users mailing list Subject: RE: Windows 7 prompting several times Apologies for keeping this going on the freeradius list when it is nothing to do with it, but has anyone seen this behaviour on anything but a Windows supplicant? I'm trying to debug whether it's a supplicant or NAS issue. As Alan has said, this is not a freeradius issue. I see the same symptoms on another network that we have, which uses Microsoft IAS. The only common ground is the OS and the Cisco authenticator (three different models: catalyst 2950, WLC4400 and WLC5500). Microsoft have analysed trace logs I have given them and pointed the finger at the NAS, but as I only see this on Windows supplicants I'm not so sure. If there is a more appropriate list to move this to then I will happily oblige to avoid the noise on the FR list. Cheers, Andi -----Original Message----- From: freeradius-users-bounces+amorris=cardiffmet.ac.uk@lists.freeradius.org [mailto:freeradius-users-bounces+amorris=cardiffmet.ac.uk@lists.freeradius.org] On Behalf Of Alan DeKok Sent: 03 April 2012 16:28 To: FreeRadius users mailing list Subject: Re: Windows 7 prompting several times jaimeventura wrote:
Now, if the user enters wrong credentials, windows prompts for credentials again with a message stating that the user credentials are invalid. The problem is that if the user now types the correct credential, the access will still be denied. After the third retry, windows gives up on asking and the user must click on the wireless network icon, to start the login process again.
See the ChangeLog for 2.1.11: * Make retry and error message configurable in mschap. See raddb/modules/mschap * Allow EAP-MSCHAPv2 to send error message to client. This change allows some clients to prompt the user for a new password. See raddb/eap.conf, mschapv2 section, "send_error".
As Alan said, this seemed like windows was caching the bad credentials. But, the logs states a different message. After the first "access denied", each retry comes with a "rlm_eap_mschapv2:Unexpected response received". Im not saying there's a freeradius fault, it can be windows fault or just windows not following the RFC(wouldnt be the first time).
I already said who to blame: That failure message is being sent by the Windows machine. FreeRADIUS just logs it. Don't blame the messenger.
Aparently windows is sending a EAP-Response/MSCHAP_Failure where it should send a EAP-Failure/MSCHAP_Failure (to acknowlage the previous sent EAP-Request/Failure, acording to RFC 'Appendix A - Examples')
Yes.
Or Should send a EAP-Response/MSCHAP_Response since it is actually retrying the authentication.
Possibly.
One possibility is that the new "send_error" option is missleading windows. According to RFC 'Appendix A - Examples', a "retry" flag in order to tell windows to try again.
FreeRADIUS sets the retry flag.
Since my knowledge of the freeradius souce code is very basic, i couldnt figure out exactly if this is happening.
You're wasting your time by looking at FreeRADIUS. The Windows box is prompting multiple times for the password. This is because the *WINDOWS BOX* is prompting multiple times for the password. It has nothing to do with FreeRADIUS. No amount of poking FreeRADIUS will fix it. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ________________________________ From 1st November 2011 UWIC changed its title to Cardiff Metropolitan University. From the 6th December 2011, as part of this change, all email addresses which included @uwic.ac.uk have changed to @cardiffmet.ac.uk. All emails sent from Cardiff Metropolitan University will now be sent from the new @cardiffmet.ac.uk address. Please could you ensure that all of your contact records and databases are updated to reflect this change. Further information can be found on the website here.<http://www3.uwic.ac.uk/English/News/Pages/UWIC-Name-Change.aspx> Ar Dachwedd y 1af 2011 newidiodd UWIC ei henw i Brifysgol Fetropolitan Caerdydd. O Ragfyr 6ed, fel rhan o'r newid yma, bydd pob cyfeiriad e-bost sy'n cynnwys @uwic.ac.uk yn newid i @cardiffmet.ac.uk. Bydd yr holl ebyst a ddanfonir o Brifysgol Fetropolitan Caerdydd yn cael eu danfon o‘r cyfeiriad @cardiffmet.ac.uk newydd. Gwnewch yn siwr eich bod yn diweddaru eich cofnodion cyswllt a'ch cronfeydd data i adlewyrchu hyn. Gellir cael rhagor o wybodaeth ar y wefan yma.<http://www3.uwic.ac.uk/English/News/Pages/UWIC-Name-Change.aspx> - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi Andi, On Wed, Apr 11, 2012 at 02:52:15PM +0000, Morris, Andi wrote:
Just to update anyone else with this issue, we have found the cause of the problem on our network was indeed the Cisco config.
Thought that would be the case (that, or Windows). Across their product range, Cisco do often seem to choose the most random defaults.
On our wireless controller we used the command below and the re-request no longer appears. I'm still playing with the timeouts for the catalyst switches for the correct timeout for these, but at least we know definitively where the problem lay.
config advanced eap identity-request-timeout 15
Apologies - I completely forgot about that earlier. We did similar last year to fix the problem, and I only remembered the client exclusion thing, not the EAP timers. We've got: config advanced eap identity-request-retries 12 config advanced eap identity-request-timeout 5 config wps client-exclusion 802.1x-auth disable http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_examp... is the Cisco page ("Manipulating EAP Timers") that tells you to change their defaults to something else... My guess (and it _is_ only a guess) is that whereas most clients ask you for the username/password, then try and connect, Windows tries to connect, autodetects that you need a user/password, and then keeps the EAP waiting while you type. If you don't type fast enough then EAP times out before Windows sends the auth, and then the process starts again, and you get prompted for the password again because it's been told not to cache auth (so it won't cache, even for a few seconds). This makes some sort of logical sense, but is a bit crazy from a user persepective. You then hit the problem that the user is a slow typer, and they hit the 802.1x authentication limit and get their client excluded for two minutes or so. We reportedly had a user sit in the helpdesk trying to log in for two hours. No comments about who would keep trying for that long (and of course the problem was self-replicating; the more they tried, the more they were excluded), but the complaints have stopped since the above three commands. Throughout all, FreeRADIUS has, of course, been happily performing fine... :) Cheers, Matthew
-----Original Message----- From: freeradius-users-bounces+amorris=cardiffmet.ac.uk@lists.freeradius.org [mailto:freeradius-users-bounces+amorris=cardiffmet.ac.uk@lists.freeradius.org] On Behalf Of Morris, Andi Sent: 03 April 2012 16:46 To: FreeRadius users mailing list Subject: RE: Windows 7 prompting several times
Apologies for keeping this going on the freeradius list when it is nothing to do with it, but has anyone seen this behaviour on anything but a Windows supplicant? I'm trying to debug whether it's a supplicant or NAS issue.
As Alan has said, this is not a freeradius issue. I see the same symptoms on another network that we have, which uses Microsoft IAS. The only common ground is the OS and the Cisco authenticator (three different models: catalyst 2950, WLC4400 and WLC5500). Microsoft have analysed trace logs I have given them and pointed the finger at the NAS, but as I only see this on Windows supplicants I'm not so sure.
If there is a more appropriate list to move this to then I will happily oblige to avoid the noise on the FR list.
Cheers, Andi
-----Original Message----- From: freeradius-users-bounces+amorris=cardiffmet.ac.uk@lists.freeradius.org [mailto:freeradius-users-bounces+amorris=cardiffmet.ac.uk@lists.freeradius.org] On Behalf Of Alan DeKok Sent: 03 April 2012 16:28 To: FreeRadius users mailing list Subject: Re: Windows 7 prompting several times
jaimeventura wrote:
Now, if the user enters wrong credentials, windows prompts for credentials again with a message stating that the user credentials are invalid. The problem is that if the user now types the correct credential, the access will still be denied. After the third retry, windows gives up on asking and the user must click on the wireless network icon, to start the login process again.
See the ChangeLog for 2.1.11:
* Make retry and error message configurable in mschap. See raddb/modules/mschap * Allow EAP-MSCHAPv2 to send error message to client. This change allows some clients to prompt the user for a new password. See raddb/eap.conf, mschapv2 section, "send_error".
As Alan said, this seemed like windows was caching the bad credentials. But, the logs states a different message. After the first "access denied", each retry comes with a "rlm_eap_mschapv2:Unexpected response received". Im not saying there's a freeradius fault, it can be windows fault or just windows not following the RFC(wouldnt be the first time).
I already said who to blame: That failure message is being sent by the Windows machine. FreeRADIUS just logs it.
Don't blame the messenger.
Aparently windows is sending a EAP-Response/MSCHAP_Failure where it should send a EAP-Failure/MSCHAP_Failure (to acknowlage the previous sent EAP-Request/Failure, acording to RFC 'Appendix A - Examples')
Yes.
Or Should send a EAP-Response/MSCHAP_Response since it is actually retrying the authentication.
Possibly.
One possibility is that the new "send_error" option is missleading windows. According to RFC 'Appendix A - Examples', a "retry" flag in order to tell windows to try again.
FreeRADIUS sets the retry flag.
Since my knowledge of the freeradius souce code is very basic, i couldnt figure out exactly if this is happening.
You're wasting your time by looking at FreeRADIUS.
The Windows box is prompting multiple times for the password. This is because the *WINDOWS BOX* is prompting multiple times for the password.
It has nothing to do with FreeRADIUS. No amount of poking FreeRADIUS will fix it.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ________________________________
From 1st November 2011 UWIC changed its title to Cardiff Metropolitan University. From the 6th December 2011, as part of this change, all email addresses which included @uwic.ac.uk have changed to @cardiffmet.ac.uk. All emails sent from Cardiff Metropolitan University will now be sent from the new @cardiffmet.ac.uk address. Please could you ensure that all of your contact records and databases are updated to reflect this change. Further information can be found on the website here.<http://www3.uwic.ac.uk/English/News/Pages/UWIC-Name-Change.aspx>
Ar Dachwedd y 1af 2011 newidiodd UWIC ei henw i Brifysgol Fetropolitan Caerdydd. O Ragfyr 6ed, fel rhan o'r newid yma, bydd pob cyfeiriad e-bost sy'n cynnwys @uwic.ac.uk yn newid i @cardiffmet.ac.uk. Bydd yr holl ebyst a ddanfonir o Brifysgol Fetropolitan Caerdydd yn cael eu danfon o‘r cyfeiriad @cardiffmet.ac.uk newydd. Gwnewch yn siwr eich bod yn diweddaru eich cofnodion cyswllt a'ch cronfeydd data i adlewyrchu hyn. Gellir cael rhagor o wybodaeth ar y wefan yma.<http://www3.uwic.ac.uk/English/News/Pages/UWIC-Name-Change.aspx>
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Architect (UNIX and Networks), Network Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
participants (10)
-
Alan Buxey -
Alan DeKok -
David Mitton -
Francois Gaudreault -
jaimeventura -
Jens Weibler -
Matthew Newton -
Morris, Andi -
Phil Mayers -
Ricardo89