Re: [RADIATOR] Extracting certificates info for EAP PEAP,TTLS,TLS

2015-02-24 Thread Christian Kratzer
Hi Sami, We made progress with our setup thanks to your previous tips. We now have following setup simplyfied a bit: Handler TunnelledByPEAP=1 Identifier TunnelledByPEAP=1 AuthByPolicy ContinueWhileAccept AuthBy SQLauthenticate AuthBy

Re: [RADIATOR] Extracting certificates info for EAP PEAP,TTLS,TLS

2015-02-24 Thread Sami Keski-Kasari
Hello Christian, MSCHAPv2 is mutual authentication protocol where client requires response from server. If the server doesn't send correct response client will terminate connection. So server can not just decide to accept authentication like in PAP case. I think that it is not possible to build

Re: [RADIATOR] Extracting certificates info for EAP PEAP,TTLS,TLS

2015-02-24 Thread Hartmaier Alexander
What we've seen is that if a Windows client does EAP authentication, regardless which one, and it fails it doesn't try to do a DHCP request even if you reply a radius success and vlan attributes to the switch. On 2015-02-24 12:12, Christian Kratzer wrote: Hi Sami, We made progress with our

Re: [RADIATOR] Extracting certificates info for EAP PEAP,TTLS,TLS

2015-02-24 Thread Christian Kratzer
Hi Sami, On Tue, 24 Feb 2015, Sami Keski-Kasari wrote: Hello Christian, MSCHAPv2 is mutual authentication protocol where client requires response from server. If the server doesn't send correct response client will terminate connection. So server can not just decide to accept

Re: [RADIATOR] Extracting certificates info for EAP PEAP,TTLS,TLS

2015-02-19 Thread Sami Keski-Kasari
Hello Christian, Answer to first question: We have used AuthBy INTERNAL between actual AuthBys to modify request message (for example in OTP cases that is very often needed to separate first and second factor). In AuthBy INTERNAL you can have for example AuthHook. Your

Re: [RADIATOR] Extracting certificates info for EAP PEAP,TTLS,TLS

2015-02-19 Thread Christian Kratzer
Hei Sami, On Thu, 19 Feb 2015, Sami Keski-Kasari wrote: Hello Christian, Answer to first question: We have used AuthBy INTERNAL between actual AuthBys to modify request message (for example in OTP cases that is very often needed to separate first and second