last hurdle...windows clients

[Craig White]

On Sun, 2008-11-23 at 02:59 -0600, Alan DeKok wrote:
> Craig White wrote:
> > OK - that quiets the notification but I still can't figure out the issue
> > where I can authenticate RRAS, Macintosh and iPod clients against radius
> > via LDAP using mschapv2 but even with the certificates on Windows XP
> > clients, with the 'xpextensions' they always try to authenticate as
> > 'uid=anonymous' and never ask me for name/password credentials to supply
> > for authentication.
> 
>   Then the supplicant is misconfigured.
> 
> > While I probably would agree that the certificates should be enough and
> > not need the user/password authentication, I can't figure out how to
> > tell radiusd to accept those with the certificates.
> 
>   No.  PEAP does MS-CHAP for username/passwd authentication.  If you
> want authentication via client certs, use TLS.
> 
> > Either way I would be happy...getting windows clients to provide
> > username/password or getting radius to accept a client with the
> > certificate.
> 
>   There's something else in your windows configuration that is making it
> *not* ask you for the username/password.  Maybe it's cached in the registry.
----
HLCU\Software\Microsoft doesn't even have an EAPOL entry at all.

fixed the cert issue but still it's trying to authenticate as
anonymous  ;-(

I realize that freeradius has little control over the supplicant but I'm
wondering if it's something in my setup of tls that the authentication
should/shouldn't be part of the tunnel because it just assumes a login
of anonymous instead of the Windows User/Password or never asks me for a
User/Password...

rad_recv: Access-Request packet from host 192.168.1.250:2054, id=168,
length=161
        User-Name = "anonymous"
        NAS-IP-Address = 192.168.1.250
        NAS-Port = 0
        Called-Station-Id = "00-21-29-E3-D1-84"
        Calling-Station-Id = "00-04-23-62-BD-3D"
        Framed-MTU = 1400
        NAS-Port-Type = Wireless-802.11
        Connect-Info = "CONNECT 11Mbps 802.11b"
        EAP-Message = 0x026300061900
        State = 0x7de5407f2f55958f61578bc598c219a9
        Message-Authenticator =
0x0682bd2213fba7b19656a91ac1454267                                                                                          
  Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 46
  modcall[authorize]: module "preprocess" returns ok for request 46
  modcall[authorize]: module "chap" returns noop for request 46
  modcall[authorize]: module "mschap" returns noop for request 46
    rlm_realm: No '@' in User-Name = "anonymous", looking up realm NULL
    rlm_realm: No such realm "NULL"
  modcall[authorize]: module "suffix" returns noop for request 46 
  rlm_eap: EAP packet type response id 99 length 6
  rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
  modcall[authorize]: module "eap" returns updated for request 46
    users: Matched entry DEFAULT at line 156
  modcall[authorize]: module "files" returns ok for request 46
rlm_ldap: - authorize
rlm_ldap: performing user authorization for anonymous
radius_xlat:  '(uid=anonymous)'
radius_xlat:  'ou=People,ou=Accounts,o=MyOrg'
rlm_ldap: ldap_get_conn: Checking Id: 0
rlm_ldap: ldap_get_conn: Got Id: 0
rlm_ldap: performing search in ou=People,ou=Accounts,o=MyOrg, with
filter (uid=anonymous)
rlm_ldap: object not found or got ambiguous search result
rlm_ldap: search failed
rlm_ldap: ldap_release_conn: Release Id: 0
  modcall[authorize]: module "ldap" returns notfound for request 46
modcall: leaving group authorize (returns updated) for request 46
  rad_check_password:  Found Auth-Type EAP
auth: type "EAP"
 Processing the authenticate section of radiusd.conf 
modcall: entering group authenticate for request 46
  rlm_eap: Request found, released from the list
  rlm_eap: EAP/peap
  rlm_eap: processing type peap
  rlm_eap_peap: Authenticate
  rlm_eap_tls: processing TLS
rlm_eap_tls: Received EAP-TLS ACK message
  rlm_eap_tls: ack handshake fragment handler
  eaptls_verify returned 1
  eaptls_process returned 13
  rlm_eap_peap:
EAPTLS_HANDLED                                                                                                                              
  modcall[authenticate]: module "eap" returns handled for request 46
modcall: leaving group authenticate (returns handled) for request 46
Sending Access-Challenge of id 168 to 192.168.1.250 port 2054
        EAP-Message =
0x0164040619400355040b130b4d61696e204f6666696365311a3018060355040313117777772e6d756c6c656e6164762e636f6d3121301f06092a864886f70d01090116126372616967406d756c6c656e70722e636f6d301e170d3038313132333030333435375a170d3138313132313030333435375a3081b8310b30090603550406130255533110300e060355040813074172697a6f6e613110300e0603550407130750686f656e69783130302e060355040a13274d756c6c656e204164766572746973696e6720616e64205075626c69632052656c6174696f6e7331143012060355040b130b4d61696e204f6666696365311a301806035504031311                                                                                              
        EAP-Message =
0x7777772e6d756c6c656e6164762e636f6d3121301f06092a864886f70d01090116126372616967406d756c6c656e70722e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100dbda8f2450e25378824b7184fd522e7bd89605a45bd721b4bb16b0d7dc11d400ffa95b3e42cb4f561e99889ccc81b680084d3d6384d4db7157422627750cecd3ec4df2237bf1ca639680ea420bdfe578e63c14e7a840086771b3b5f5e7669b16d89adead0b5a5be27df7b75a91e4767f47c395b1aaddbb592427ed1998fbbb590203010001a382011930820115301d0603551d0e0416041481223bdff5d466a37f81d26e04deec9fe039fbe2                                                                                              
        EAP-Message =
0x3081e50603551d230481dd3081da801481223bdff5d466a37f81d26e04deec9fe039fbe2a181bea481bb3081b8310b30090603550406130255533110300e060355040813074172697a6f6e613110300e0603550407130750686f656e69783130302e060355040a13274d756c6c656e204164766572746973696e6720616e64205075626c69632052656c6174696f6e7331143012060355040b130b4d61696e204f6666696365311a3018060355040313117777772e6d756c6c656e6164762e636f6d3121301f06092a864886f70d01090116126372616967406d756c6c656e70722e636f6d820100300c0603551d13040530030101ff300d06092a8648                                                                                              
        EAP-Message =
0x86f70d010104050003818100768e3a090efeb6defd2310b970964f5b50dd48dd7d740d5f90784cc29688818dd3df60d71a7c06cd9a6c08ac0690df4102b1168ad2c73433558b66f96f1fcee9fd465028e75309c207400f6f7628de7917667c71472930176924b2078cf0b9e007698319fa93199d76c5c69f25936a232a3258e01f99a23798297dfd196ef37b160301010d0c0001090040bcd70764bd8eeff9e536574ff3b2f404043cc23d501c99a5b93d5edd5a8330c40b6e1bb3b2418f455d6511b978ae7e142b35bbf17e9dde8ae088b6bd5770253f00010500409f8a29eea3c97af2ee158cbabf6f536272a84e548678d53c4711c721cedda7c143                                                                                              
        EAP-Message =
0x7f47f869ba7025d999bf4a37469dd40ec3cc                                                                                                
        Message-Authenticator = 0x00000000000000000000000000000000
        State = 0x28ab70e596615ccdfa8d83b1787bc31e