Thanks for replying and sorry if I'm being vague, I'll try and be more specific.
On Tue, Oct 23, 2012 at 10:59 AM, Phil Mayers <p.may...@imperial.ac.uk> wrote: > On 10/22/2012 09:13 AM, Daniel Ekman wrote: >> >> Hi list, >> >> I have a fairly large user base doing WPA2-enterprise from various >> OS'es and smartphones, our FreeRADIUS is running v.2.1.12 and is >> authenticating via LDAP and things are running pretty well, only snag >> I have currently with this is when people change their password. I > > > Change their password where? Elsewhere, right? So, you want to prompt the > clients to enter a new password, because the user has changed passwords on > the server. > Yes, clients change their password on the server via a custom web interface on top of the LDAP and this then obviously do not get automatically updated on the wireless settings on the clients computer. > >> in the latest version allow_retry and retry_msg in the mschap module >> was implemented and this works great on my mac and linux userbase, >> however it does not work for the windows users, the FreeRADIUS server >> is still sending the same things to the user but for some reason there >> is no popup telling the user to change their password so here is my >> actual question, is this supposed to work? should the windows users >> also get the popup saying "please change password"? > > > Your terminiology is confusing. Do you mean "change password" or "re-enter > your password". Because the two are very, very different. Re-enter the password in the wireless setup if they do not get authenticated. > > To be honest, your email is sort of vague and specific at the same time, if > that makes any sense - there's some LDAP, some different set of accounts, > something else... > > I've got no idea if Windows can even behave the way you want > > >> >> judging from what some threads say like this for example >> >> http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg68678.html > > > That message predates major changes to the PEAP and EAP-MSCHAPv2 modules to > support password *change* (see why I said it was confusing?). So I'd be > cautious about reading too much into it. > > >> seems to indicate there are problems but it also sounds like there is >> a solution. >> >> I have also tried adding the send_error setting in eap.conf but that >> only broke things like I read somewhere it would. > > > ...vague much? the send_error was added to version 2.1.11 as a bug fix "Allow EAP-MSCHAPv2 to send error message to client. This change allows some clients to prompt the user for a new password. See raddb/eap.conf, mschapv2 section, "send_error"." This was said in earlier version to solve issues for some clients but *may* also cause other clients to stop working. The setting is also not included in version 2.1.12 eap.conf. > > Seriously: "radiusd -X" radiusd -X gives the same output to mac/windows/linux users when they need to re-enter their password but only the mac/linux users get a prompt for it. > > If I have time today, I'll try to resurrect our "for comparison" NPS server > and see what Microsoft do. It's possible you just can't prompt Windows in > the way you want. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html