Freeradius reply attribute problem when using PEAP

[Dale Blount]

Hello,

I'm helping Terry out with this issue.  Apologies if this doesn't thread
correctly as I wasn't subscribed to the list during the original email
thread and Terry is not available.


On Tue, 2014-08-12 at 10:56 -0400, Alan DeKok wrote:
> Terry Kantorowski wrote:
> > Per your request. I have included the debug output from freeradius.
> > You will see that my test user "rickjames" authenticates just fine.
> > The problem I am having is that the attribute value pairs for his
> > group are not passed and so he never actually "connects" to the
> > wireless network. The AVPs are missing when I try to connect with a
> > device using PEAP, but present when I force connect with TTLS. I did
> > not see this until I ran tcpdump.
> 
>   Which is why all of the documentation tells you to run the server in
> debugging mode, and to read the output.
> 

I've gone through the logs but cannot find the issue that is causing the
attributes not to pass.  The Ruckus-Role attribute is found throughout
the whole log up until line ~1432 of ttls6.log and ~1761 of peap6.log.

Also of note is line 1508-1509 of ttls6.log:
(9) eap_ttls : Using saved attributes from the original Access-Accept
	Ruckus-Role = 'TestSite-Premium'

And 1849-1850 of peap6.log:
(12) eap_peap : Using saved attributes from the original Access-Accept
	User-Name = 'rickjames'


Both logs are available here:
http://dale.us/temp/peap6.log
http://dale.us/temp/ttls6.log



>   It should be pretty clear from the output.  There's a lot of it, but
> reading it is simple.
> 
> > (11)  eap_peap : Got tunneled reply code 2
> >         MS-MPPE-Encryption-Policy = Encryption-Allowed
> >         MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed
> >         MS-MPPE-Send-Key = 0x179df4ed5c7771b6728858f3b86294c2
> >         MS-MPPE-Recv-Key = 0xb9fea9733904585d418bc4af62e467f3
> >         EAP-Message = 0x030b0004
> >         Message-Authenticator = 0x00000000000000000000000000000000
> >         User-Name = 'rickjames'
> 
>   So... no authorization attributes are in the tunnel.
> 
>   Fix that.

Agreed.  I am seeing this on the new debug files as well.


Does PEAP require a different inner-tunnel than TTLS does?  At the
moment they are both using the same default inner-tunnel.

Thanks,

Dale