EAP-PEAP + Windows 7 with SSO and Password change

[CD DD]

Hi Phil,


> src/modules/rlm_eap/types/rlm_eap_mschapv2/rlm_eap_mschapv2.c:
>
> about line 741, maybe this:
>
>    pairmove2(&response, &handler->request->reply->vps,
>              PW_MSCHAP_ERROR, 0);
>
> ...should be:
>
>    pairmove2(&response, &handler->request->reply->vps,
>              PW_MSCHAP_ERROR, VENDORSPEC_MICROSOFT);
>
> ?
>
> I don't understand though; I tested this as working, so
>
> Unfortunately my testbed is no longer assembled :o(


your fix works perfectly.

But it have to be:

>              PW_MSCHAP_ERROR, VENDORPEC_MICROSOFT);
instead
>              PW_MSCHAP_ERROR, VENDORSPEC_MICROSOFT);

<snip>
:
Exec-Program output: Must change password (0xc0000224)
Exec-Program-Wait: plaintext: Must change password (0xc0000224)
Exec-Program: returned: 1
(8) mschap : ntlm_auth says password must change
(8)   [mschap] = reject
  MSCHAP-Error: ?E=648 R=0 C=07cc36ab334ac36c8af4bc87201b552a V=3 M=Password Expired
  Found new challenge from MS-CHAP-Error: err=648 retry=0 challenge=07cc36ab334ac36c8af4bc87201b552a
:
</snip>

The windows client get now the password change Window.

But i still have one issue:
the new passphrase will not changed.

I got: MS-CHAP-NT-Enc-PW with invalid format

here are the output from debug:

<snip>
:
(9) # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel
(9)   group authenticate {
(9)  - entering group authenticate {...}
(9) eap : Request found, released from the list
(9) eap : EAP/mschapv2
(9) eap : processing type mschapv2
  rlm_eap_mschapv2: password change packet received
  rlm_eap_mschapv2: built change password packet
        EAP-Message = 0x020f024f1a070f024a7979c8bf7d1f48b508f3a77a6cf40c3b323e89bcd5407e2e5cb01cc46a4b647d1e8fe79e297aa65d676f10889d59b1c80cd7a3298d0c534821973b09
0992bae04d4d23a9d5d8f07f27cb11d98d0d4826d32098afc30bf72d9144cf7eb48961880421962a26877e3a12250621d8121e26041120ce25774a0a4671d1df838f83efb44072540349c518d1679ed8c31782d104b9e8fd27da45f0b130d9b0af78ff02021ce997841fd0bbcd91aaa610575f9a6212b842563b710cb0c8410f47d51a38b3a6d1818909d2fb4735346c8b611b3ba0dde0cf6efa446c2605975e5016c24b30888d918e0b0a03352d7a51d2eee48f14b77b0d
        EAP-Message = 0x4a085ae945764de443cd775041a3138f227f90600ec3d8b2cc9648a5144dcb10918bc499d5c939677d1c15fadfbe9761da908e0fe8a864e8e4631b92f26d2ec3f98ba74263bac7072037c42b609f6e163176bafba7f25c5d1e9f4418a517e4d1179701510116215825d33a639a1e83fecf8835482f3f1dcd909fad60c03bd8b6bd7c557df2bcea320a1339dc01f028f0901d10e30119bf2a2b417cb69ab37d5e5223bb02bc506bbc21993f7a659000d12ec6c58153a4fa90679feb094bace85de10626834f59f5c751cf82f8854f862eb850759d4304b64490e752f6ab27b6bfcb90f9eb92559f3b584dca6fd0b77aff1220cbf491fd3c3f6d9b29ed6f
        EAP-Message = 0x6220d11763505a3f83f3ba6b811924ec987ba0515d6f99d4b584888d36ab9af03e3f2120bb50aa142cd1843d1b8c6975777c150000000000000000f32ed76d7f602a6fba828238448651148ebe123062e60af10000
        FreeRADIUS-Proxied-To = 127.0.0.1
        User-Name = "TEST\\user1"
        State = 0x42f25dad43fd47b2696e125eaff8db99
	Acct-Multi-Session-Id = "00-A1-B1-4D-D4-78-A1-23-DF-79-F0-B9-4F-D8-55-5F-00-04-FE-67"
        Acct-Session-Id = "b82ba75a-00000133"
        NAS-Port = 291
        NAS-Port-Type = Wireless-802.11
        NAS-Identifier = "AP"
        NAS-IP-Address = 10.0.1.50
        Framed-MTU = 1496
	Calling-Station-Id = "A1-23-DF-79-F0-B9"
	Called-Station-Id = "00-A1-B1-4D-D4-78"        
        Service-Type = Framed-User
        EAP-Type = MS-CHAP-V2
        MS-CHAP-Challenge = 0x07cc36db334dc36c8af4bc87201b552a
        MS-CHAP2-CPW = 0x070f515d6f99d4b584888d36ab9af03a3f2120bc50aa142cd1843d1b8c6975777c150000000000000000f32ed76d7f602a6fba828238448651148ebe123062e60af10000
        MS-CHAP-NT-Enc-PW += 0x060f00017979c8bf7d1f48b508f3a56a6cf40c3b323e89bcd5407e2e5fb01cc46a4b647d1e8fe79e297aa65d676f10889d59b1c80cd7a3298d0c534821973b090992a7e04d4d23a9d5d8f07f27cb11d98d0d4826d32098afc30bf72d9144cf7eb48961880421962a26877e3a12250621d8121e26041120ce25774a0a4671d1df838f83efb44072540349c518d1679ed8c31782d104b9e8fd27da45f0b130d9b0af78ff02021ce997841fd0bbcd91aaa610575f9a6212b842563b710cb0c8410f47d51a38b3a6d1818909d2fb4735346c8b611b3ba0dde0cf6efa446c2605975e5016c24b30888d918e0b0a03352d7a51d2eee48f14b77b
        MS-CHAP-NT-Enc-PW += 0x060f00020d4a085ae945764de443cd775041a3138f211f90600ec3d8b2cc9648a5144dcb10918bc499d5c939677d1c15fadfbe9761da908e0fe8a864e8e4631b92f26d2ec3f98ba74263bac7072037c42b609f6e163176bafba7f25c5d1e9f4418a517e4d1179701510116215825d33a639a1e83fecf8835482f3f1dcd909fad60c03bd8b6bd7c557df2bcea320a1339dc01f028f0901d10e30119bf2a2b417cb69ab37d5e5223bb02bc506bbc21993f7a659000d12ec6c58153a4fa90679feb094bace85de10626834f59f5c751cf82f8854f862eb850759d4304b64490e752f6ab27b6bfcb90f9eb92559f3b584dca6fd0b77aff1220
        MS-CHAP-NT-Enc-PW += 0x060f0003cbf491ad3c3f6d9b29ed6f6220d11763505a3f83f3ba6b811924ec987ba0
(9) mschapv2 : # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel
(9) mschapv2 :   group MS-CHAP {
(9) mschapv2 :  - entering group MS-CHAP {...}
(9) mschap : MS-CHAPv2 password change request received
(9) mschap : MS-CHAP-NT-Enc-PW with invalid format
(9)   [mschap] = invalid
rlm_eap_mschapv2: No MS-CHAPv2-Success or MS-CHAP-Error was found.
(9) eap : Handler failed in EAP/mschapv2
(9) eap : Failed in EAP select
(9)   [eap] = invalid
(9) Failed to authenticate the user.
:
</snip>

thanks,

C.




-- 
Empfehlen Sie GMX DSL Ihren Freunden und Bekannten und wir
belohnen Sie mit bis zu 50,- Euro! https://freundschaftswerbung.gmx.de