Yes, an workmate last year with OS/X 10.6 or 10.7, locale pt_PT, trying to login using a ' char as part of the password. Regards, Rui Ribeiro pt.linkedin.com/pub/rui-ribeiro/16/ab8/434/

----------------------------------------------------------------------

Message: 1 Date: Wed, 14 May 2014 14:44:27 +0200 From: Olivier Beytrison <olivier@heliosnet.org> To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Mac OSX + PEAP/MSCHAPv2 + Special characters in password Message-ID: <5373652B.80705@heliosnet.org> Content-Type: text/plain; charset=ISO-8859-1

Hello,

One of our institution reported that some of their users, using Mac OSX, couldn't connect to eduroam. It appears that those users have special characters in their password (???? ect).

I can log with such an account using Windows, iOS, Android or eapol_test, but with the default settings on Mac OSX (PEAP/MSCHAPv2) it fails : mschap : MS-CHAP2-Response is incorrect.

The current workaround at the moment is to deploy a .mobileconfig profile to configure their 802.1x settings to use TTLS/PAP, which works correctly.

We spent some time debugging this issue with Arran and think that's an implementation error by MacOSX regarding the encoding of the password used to generated the hash for MSCHAPv2. But so far I wasn't able to confirm it by looking at the Apple discussion forums.

Has anyone of you also encountered this issue ?

Regards, Olivier B. --

Olivier Beytrison Network & Security Engineer, HES-SO Fribourg Mail: olivier@heliosnet.org