Re: Working around broken EAP client

2013-06-13 Thread Gordon Ross 
On 11 Jun 2013, at 16:06, Alan DeKok  wrote:

>  That's really not what I said to do.  I said set User-Name to be the
> MS-CHAP identity.  You've got that inverted.
> 
>   update request {
>   User-Name := %{mschap:User-Name}
>   }


This worked a treat. Thank you very much !

GTG
-- 
Gordon Ross
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Working around broken EAP client

2013-06-11 Thread Gordon Ross 
On 11 Jun 2013, at 14:32, Alan DeKok 
 wrote:

> Gordon Ross wrote:
>> In the meantime, is there anything I can do to accept these requests ?
> 
>  Set the User-Name to be the same as the MS-CHAP identity.


How and where do I do that ? In the inner part by something close to:

update request {
MS-CHAP-User-Name = "%{request:User-Name}"
}

?

GTG
-- 
Gordon Ross
Computing Service

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Working around broken EAP client

2013-06-11 Thread Gordon Ross 
On 11 Jun 2013, at 13:59, Alan DeKok  wrote:

>  It appears that behavior is allowed.  I've had discussions with the
> people doing the standards.  And the MS-CHAP identity has *no* relation
> to the EAP-Identity.
> 
>  It's insane, but that's how it works.
> 
>  I think for v2.2.1, it's best to make that check configurable, instead
> of an error.


In the meantime, is there anything I can do to accept these requests ?

GTG
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Working around broken EAP client

2013-06-11 Thread Gordon Ross 
I'm using Freeradius 2.1.10 as supplied with Ubuntu 12.04

I'm wanting to use Freeradius to authenticate 802.1x clients. However, one 
client I need to authenticate I believe is "broken", in that it's stripping the 
suffix on the inner identity.

>From running freeradius -X I see:

[mschap] ERROR: User-Name (68...@phone.cam.ac.uk) is not the same as MS-CHAP 
Name (68983) from EAP-MSCHAPv2

Putting the same credentials into an iPhone allows the iPhone to sign onto the 
network without problems. So I feel it's the client that's broken, and not my 
freeradius setup.

I've seen some warnings that fixing the identity mis-match is a Bad Idea, but I 
need to get this client to work.

I found a page[1] that has a similar problem, but for Windows domain prefixes 
being stripped. It suggests that adding:

if ( User-Name =~ /^machine.*/ ) {
 update request {
 MS-CHAP-User-Name = "%{request:User-Name}"
 }
}

to the inner configuration will fix it.

Is it possible to do something similar to add the suffix if it's missing ?

Thanks,

GTG
-- 
Gordon Ross

[1] 
http://www.packetfence.org/support/faqs/article/authentication-error-user-name-is-not-the-same-as-ms-chap-name-from-eap-mschapv2.html?no_cache=1&cHash=557619254a0e733446140dcefbced985
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html