PEAP authentication very strange problem! PLEASE HELP

Discussion:

g***@etu.enseeiht.fr

2004-01-14 14:20:26 UTC

hello everyone,
I have a very strange problem while I try to do PEAP authentication...
I have successfully made TLS authentication, TTLS also works with secureW2
client, but when I tried to do PEAP authentication, I have a very strange
problem:
I am using a snaphot of freeradius from 2004/01/04 ,my supplicant is
windows XP SP1 with all patch, and when I do PEAP authentication, all is
fine for freeradius : I have an access accept and MPPE received and send
key that are printed out. all seems to be good, my AP (which is cisco ap)
says in the log : "eap authenticated successfull = username ", the same
message that I had when TLS and TTLS worked.
But in the same time, in Windows side, I have already the same message :
"wait for authentication".... and it's not really authenticated because I
can't do a ping or something like that. I dont have the good message :
authentication successfull, which appeared with TLS and TTLS.
But why ??? I really dont understand what is not good here... I think it's
a problem in windows side, don't you think so?? SI it possible ti be a
problem with freeradius or my AP ?? please if someone knows, help me!

Renaud Garelli

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

g***@etu.enseeiht.fr

2004-01-15 08:09:34 UTC

Permalink

Anybody knows about this problem...? please help if you have an idea!!!
thanks a lot

Post by g***@etu.enseeiht.fr
hello everyone,
I have a very strange problem while I try to do PEAP authentication...
I have successfully made TLS authentication, TTLS also works with secureW2
client, but when I tried to do PEAP authentication, I have a very strange
I am using a snaphot of freeradius from 2004/01/04 ,my supplicant is
windows XP SP1 with all patch, and when I do PEAP authentication, all is
fine for freeradius : I have an access accept and MPPE received and send
key that are printed out. all seems to be good, my AP (which is cisco ap)
says in the log : "eap authenticated successfull = username ", the same
message that I had when TLS and TTLS worked.
"wait for authentication".... and it's not really authenticated because I
authentication successfull, which appeared with TLS and TTLS.
But why ??? I really dont understand what is not good here... I think it's
a problem in windows side, don't you think so?? SI it possible ti be a
problem with freeradius or my AP ?? please if someone knows, help me!
Renaud Garelli
-
List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

matt morris

2004-01-15 14:37:57 UTC

Permalink

I read a post from a user named Mike Saywell, stating a similar situation
"Failing Auth because we got a success/fail without TLV."

The file RASTLS.LOG is the WindowsXP log, obtained by setting the
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASTLS\EnableFileTracing
flag to 1.

And if you got the same thing from the log, here's the answer to Mike from

I can authenticate with XSupplicant under Linux fine, but Windows fails
apparently with the error "Failing Auth because we got a success/fail
without TLV."

Hmm... it looks like the PEAP module puts the data into a buffer, to
be put into the TLS tunnel, but the tls code never looks for it on
success/failure.
The functions in eap_tls.c, eaptls_success() and eaptls_fail() have
to be updated to look a little more like eaptls_request(). i.e. to
call record_minus(), etc, to grab the data from the buffer, and put it
into the tunnel.

In the peap section I've tried various combinations of the
copy_request_to_tunnel and use_tunneled_reply flags to no avail -
including leaving them unspecified.

That won't work, as the code is just wrong.

Hopefully somebody can spot what is probably a silly mis-configuration
on my part!

Nope.
PEAP probably works on other systems because they don't look for the
"TLV" response code, like they're supposed to. XP does, so it fails
when the PEAP module doesn't supply the TLV.
Alan DeKok.

Hope this helps

Subject: Re: PEAP authentication very strange problem! PLEASE HELP
Date: Thu, 15 Jan 2004 09:09:34 +0100 (MET)
Anybody knows about this problem...? please help if you have an idea!!!
thanks a lot

hello everyone,
I have a very strange problem while I try to do PEAP authentication...
I have successfully made TLS authentication, TTLS also works with

secureW2

client, but when I tried to do PEAP authentication, I have a very

strange

I am using a snaphot of freeradius from 2004/01/04 ,my supplicant is
windows XP SP1 with all patch, and when I do PEAP authentication, all is
fine for freeradius : I have an access accept and MPPE received and send
key that are printed out. all seems to be good, my AP (which is cisco

ap)

says in the log : "eap authenticated successfull = username ", the same
message that I had when TLS and TTLS worked.
"wait for authentication".... and it's not really authenticated because

authentication successfull, which appeared with TLS and TTLS.
But why ??? I really dont understand what is not good here... I think

it's

a problem in windows side, don't you think so?? SI it possible ti be a
problem with freeradius or my AP ?? please if someone knows, help me!
Renaud Garelli
-
List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html

-
List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html

_________________________________________________________________
The new MSN 8: advanced junk mail protection and 2 months FREE*
http://join.msn.com/?page=dept/bcomm&pgmarket=en-ca&RU=http%3a%2f%2fjoin.msn.com%2f%3fpage%3dmisc%2fspecialoffers%26pgmarket%3den-ca

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Mike Saywell

2004-01-16 02:25:27 UTC

Permalink

It took me a while to figure out what was going on here...

Turns out the problem was not as Alan suspected. Seems that a return
value got tweaked during a re-structuring of the code.

Anyway here's the (very small) patch:

--- peap.c.orig Fri Jan 16 02:01:45 2004
+++ peap.c Fri Jan 16 02:02:03 2004
@@ -267,7 +267,7 @@
DEBUG2(" PEAP: Tunneled authentication was successful.");
t->status = PEAP_STATUS_SENT_TLV_SUCCESS;
eappeap_success(handler, tls_session);
- rcode = RLM_MODULE_OK;
+ rcode = RLM_MODULE_HANDLED;

/*
* If we've been told to use the attributes from

I only spotted the change when comparing a version I checked out from
november which worked ok. I'm not sure if the change was intentional,
but reversing it gets PEAP working again for me.

Oh btw has something changed in the configure/makefiles recently?
Just that to compile TLS/TTLS support I currently have to run:

./configure --with-openssl-includes=/usr/include/ --with-openssl-libraries=/usr/lib/

It's only started happening recently, perhaps it's something weird in
my setup, I'm too tired to care right now ;)

Cheers,

Mike

Post by matt morris
I read a post from a user named Mike Saywell, stating a similar situation
"Failing Auth because we got a success/fail without TLV."
The file RASTLS.LOG is the WindowsXP log, obtained by setting the
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASTLS\EnableFileTracing
flag to 1.
And if you got the same thing from the log, here's the answer to Mike from

I can authenticate with XSupplicant under Linux fine, but Windows fails
apparently with the error "Failing Auth because we got a success/fail
without TLV."

In the peap section I've tried various combinations of the
copy_request_to_tunnel and use_tunneled_reply flags to no avail -
including leaving them unspecified.

That won't work, as the code is just wrong.

Hopefully somebody can spot what is probably a silly mis-configuration
on my part!

Nope.
PEAP probably works on other systems because they don't look for the
"TLV" response code, like they're supposed to. XP does, so it fails
when the PEAP module doesn't supply the TLV.
Alan DeKok.

Hope this helps

Subject: Re: PEAP authentication very strange problem! PLEASE HELP
Date: Thu, 15 Jan 2004 09:09:34 +0100 (MET)
Anybody knows about this problem...? please help if you have an idea!!!
thanks a lot

hello everyone,
I have a very strange problem while I try to do PEAP authentication...
I have successfully made TLS authentication, TTLS also works with

secureW2

client, but when I tried to do PEAP authentication, I have a very

strange

ap)

says in the log : "eap authenticated successfull = username ", the same
message that I had when TLS and TTLS worked.
"wait for authentication".... and it's not really authenticated because

authentication successfull, which appeared with TLS and TTLS.
But why ??? I really dont understand what is not good here... I think

it's

-
List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html

_________________________________________________________________
The new MSN 8: advanced junk mail protection and 2 months FREE*
http://join.msn.com/?page=dept/bcomm&pgmarket=en-ca&RU=http%3a%2f%2fjoin.msn.com%2f%3fpage%3dmisc%2fspecialoffers%26pgmarket%3den-ca
-
List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

g***@etu.enseeiht.fr

2004-01-16 08:32:22 UTC

Permalink

hi!
I would like to test your patch but I don't know where I must put it!
Should I have to create a file and put your patch inside? and the file
must be put in which directory?
thanks a lot!
renaud

Post by Mike Saywell
It took me a while to figure out what was going on here...
Turns out the problem was not as Alan suspected. Seems that a return
value got tweaked during a re-structuring of the code.
--- peap.c.orig Fri Jan 16 02:01:45 2004
+++ peap.c Fri Jan 16 02:02:03 2004
@@ -267,7 +267,7 @@
DEBUG2(" PEAP: Tunneled authentication was successful.");
t->status = PEAP_STATUS_SENT_TLV_SUCCESS;
eappeap_success(handler, tls_session);
- rcode = RLM_MODULE_OK;
+ rcode = RLM_MODULE_HANDLED;
/*
* If we've been told to use the attributes from
I only spotted the change when comparing a version I checked out from
november which worked ok. I'm not sure if the change was intentional,
but reversing it gets PEAP working again for me.
Oh btw has something changed in the configure/makefiles recently?
./configure --with-openssl-includes=/usr/include/
--with-openssl-libraries=/usr/lib/
It's only started happening recently, perhaps it's something weird in
my setup, I'm too tired to care right now ;)
Cheers,
Mike

I can authenticate with XSupplicant under Linux fine, but Windows

fails

apparently with the error "Failing Auth because we got a success/fail
without TLV."

In the peap section I've tried various combinations of the
copy_request_to_tunnel and use_tunneled_reply flags to no avail -
including leaving them unspecified.

That won't work, as the code is just wrong.

Hopefully somebody can spot what is probably a silly mis-configuration
on my part!

Nope.
PEAP probably works on other systems because they don't look for the
"TLV" response code, like they're supposed to. XP does, so it fails
when the PEAP module doesn't supply the TLV.
Alan DeKok.

Hope this helps

Subject: Re: PEAP authentication very strange problem! PLEASE HELP
Date: Thu, 15 Jan 2004 09:09:34 +0100 (MET)
Anybody knows about this problem...? please help if you have an idea!!!
thanks a lot

hello everyone,
I have a very strange problem while I try to do PEAP

authentication...

I have successfully made TLS authentication, TTLS also works with

secureW2

client, but when I tried to do PEAP authentication, I have a very

strange

I am using a snaphot of freeradius from 2004/01/04 ,my supplicant is
windows XP SP1 with all patch, and when I do PEAP authentication, all

fine for freeradius : I have an access accept and MPPE received and

send

key that are printed out. all seems to be good, my AP (which is cisco

ap)

says in the log : "eap authenticated successfull = username ", the

same

message that I had when TLS and TTLS worked.
But in the same time, in Windows side, I have already the same
"wait for authentication".... and it's not really authenticated

because

can't do a ping or something like that. I dont have the good message
authentication successfull, which appeared with TLS and TTLS.
But why ??? I really dont understand what is not good here... I think

it's

a problem in windows side, don't you think so?? SI it possible ti be

problem with freeradius or my AP ?? please if someone knows, help me!
Renaud Garelli
-
List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html

-
List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html

_________________________________________________________________
The new MSN 8: advanced junk mail protection and 2 months FREE*
http://join.msn.com/?page=dept/bcomm&pgmarket=en-ca&RU=http%3a%2f%2fjoin.msn.com%2f%3fpage%3dmisc%2fspecialoffers%26pgmarket%3den-ca
-
List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html

-
List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Mike Saywell

2004-01-16 11:52:17 UTC

Permalink

The file is in src/modules/rlm_eap/types/rlm_eap_peap

Just change line 267 as shown :)

Mike

Post by g***@etu.enseeiht.fr
hi!
I would like to test your patch but I don't know where I must put it!
Should I have to create a file and put your patch inside? and the file
must be put in which directory?
thanks a lot!
renaud

I can authenticate with XSupplicant under Linux fine, but Windows

fails

apparently with the error "Failing Auth because we got a success/fail
without TLV."

In the peap section I've tried various combinations of the
copy_request_to_tunnel and use_tunneled_reply flags to no avail -
including leaving them unspecified.

That won't work, as the code is just wrong.

Hopefully somebody can spot what is probably a silly mis-configuration
on my part!

Nope.
PEAP probably works on other systems because they don't look for the
"TLV" response code, like they're supposed to. XP does, so it fails
when the PEAP module doesn't supply the TLV.
Alan DeKok.

Hope this helps

Subject: Re: PEAP authentication very strange problem! PLEASE HELP
Date: Thu, 15 Jan 2004 09:09:34 +0100 (MET)
Anybody knows about this problem...? please help if you have an idea!!!
thanks a lot

hello everyone,
I have a very strange problem while I try to do PEAP

authentication...

I have successfully made TLS authentication, TTLS also works with

secureW2

client, but when I tried to do PEAP authentication, I have a very

strange

I am using a snaphot of freeradius from 2004/01/04 ,my supplicant is
windows XP SP1 with all patch, and when I do PEAP authentication, all

fine for freeradius : I have an access accept and MPPE received and

send

key that are printed out. all seems to be good, my AP (which is cisco

ap)

says in the log : "eap authenticated successfull = username ", the

same

message that I had when TLS and TTLS worked.
But in the same time, in Windows side, I have already the same
"wait for authentication".... and it's not really authenticated

because

it's

a problem in windows side, don't you think so?? SI it possible ti be

problem with freeradius or my AP ?? please if someone knows, help me!
Renaud Garelli
-
List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html

-
List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html

_________________________________________________________________
The new MSN 8: advanced junk mail protection and 2 months FREE*
http://join.msn.com/?page=dept/bcomm&pgmarket=en-ca&RU=http%3a%2f%2fjoin.msn.com%2f%3fpage%3dmisc%2fspecialoffers%26pgmarket%3den-ca
-
List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html

-
List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Alan DeKok

2004-01-19 01:33:10 UTC

Permalink

Post by Mike Saywell
Turns out the problem was not as Alan suspected. Seems that a return
value got tweaked during a re-structuring of the code.

Ah... that's probably my fault. Sorry.
The change results in the magic PEAP "success" TLV being returned to
the client, and *then* an Access-Accept. The result is similar to
what I had said before about fixing the problem.

I'll apply the patch on Monday.

Alan DeKok.

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Alan DeKok

2004-01-19 19:10:26 UTC

Permalink

Post by Mike Saywell
Turns out the problem was not as Alan suspected. Seems that a return
value got tweaked during a re-structuring of the code.

Added, thanks.

Alan DeKok.

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

g***@etu.enseeiht.fr

2004-01-16 08:25:12 UTC

Permalink

Thanks for your help!
But I think it not exactly the same problem that I have:
In my problem, I have a Access ACCEPT from the freeradius serveur, with a
successful authentication ( MPPE key received and send are printed on
freeradius side and seems to be OK)
The Access point also print in his logs : "authentication EAP sucessful =
username"
But it seems that Windows XP doesn't understand!! It is again and again
bloked on "authentication waiting"
My question is : is it possible that the problem could come from
freeradius or not? do you think freeradius is good and my problem is on
windows side?? (XP Sp1 with all patch)
Thanks!!
renaud

I can authenticate with XSupplicant under Linux fine, but Windows fails
apparently with the error "Failing Auth because we got a success/fail
without TLV."

In the peap section I've tried various combinations of the
copy_request_to_tunnel and use_tunneled_reply flags to no avail -
including leaving them unspecified.

That won't work, as the code is just wrong.

Hopefully somebody can spot what is probably a silly mis-configuration
on my part!

Nope.
PEAP probably works on other systems because they don't look for the
"TLV" response code, like they're supposed to. XP does, so it fails
when the PEAP module doesn't supply the TLV.
Alan DeKok.

Hope this helps

Subject: Re: PEAP authentication very strange problem! PLEASE HELP
Date: Thu, 15 Jan 2004 09:09:34 +0100 (MET)
Anybody knows about this problem...? please help if you have an idea!!!
thanks a lot

hello everyone,
I have a very strange problem while I try to do PEAP authentication...
I have successfully made TLS authentication, TTLS also works with

secureW2

client, but when I tried to do PEAP authentication, I have a very

strange

I am using a snaphot of freeradius from 2004/01/04 ,my supplicant is
windows XP SP1 with all patch, and when I do PEAP authentication, all

fine for freeradius : I have an access accept and MPPE received and

send

key that are printed out. all seems to be good, my AP (which is cisco

ap)

says in the log : "eap authenticated successfull = username ", the

same

message that I had when TLS and TTLS worked.
But in the same time, in Windows side, I have already the same message
"wait for authentication".... and it's not really authenticated

because
I

authentication successfull, which appeared with TLS and TTLS.
But why ??? I really dont understand what is not good here... I think

it's

-
List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html

_________________________________________________________________
The new MSN 8: advanced junk mail protection and 2 months FREE*
http://join.msn.com/?page=dept/bcomm&pgmarket=en-ca&RU=http%3a%2f%2fjoin.msn.com%2f%3fpage%3dmisc%2fspecialoffers%26pgmarket%3den-ca
-
List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

matt morris

2004-01-18 02:54:14 UTC

Permalink

Hello, Mike. Just a verification: So you replaced "rcode = RLM_MODULE_OK;"
with "rcode = RLM_MODULE_HANDLED;"? I tried that and the winxp supplicant
can indeed connect successfully. However, the user was not prompted for the
username and password on subsequent reboots and can still get access to the
internet after that one successful login. Is that an expected result? (My
desired result should be the user get prompted to authenticate everytime
he/she reboots or loads up winxp in order to gain access. Is that an ip
least time problem, or a cookie/temp file problem or the modifed peap
module's problem?

TIA

Subject: [PATCH] Re: PEAP authentication very strange problem! PLEASE HELP
Date: Fri, 16 Jan 2004 02:25:27 +0000
It took me a while to figure out what was going on here...
Turns out the problem was not as Alan suspected. Seems that a return
value got tweaked during a re-structuring of the code.
--- peap.c.orig Fri Jan 16 02:01:45 2004
+++ peap.c Fri Jan 16 02:02:03 2004
@@ -267,7 +267,7 @@
DEBUG2(" PEAP: Tunneled authentication was successful.");
t->status = PEAP_STATUS_SENT_TLV_SUCCESS;
eappeap_success(handler, tls_session);
- rcode = RLM_MODULE_OK;
+ rcode = RLM_MODULE_HANDLED;
/*
* If we've been told to use the attributes from
I only spotted the change when comparing a version I checked out from
november which worked ok. I'm not sure if the change was intentional,
but reversing it gets PEAP working again for me.
Oh btw has something changed in the configure/makefiles recently?
./configure --with-openssl-includes=/usr/include/
--with-openssl-libraries=/usr/lib/
It's only started happening recently, perhaps it's something weird in
my setup, I'm too tired to care right now ;)
Cheers,
Mike

Post by matt morris
I read a post from a user named Mike Saywell, stating a similar

situation

Post by matt morris
"Failing Auth because we got a success/fail without TLV."
The file RASTLS.LOG is the WindowsXP log, obtained by setting the
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASTLS\EnableFileTracing
flag to 1.
And if you got the same thing from the log, here's the answer to Mike

from

Post by matt morris

I can authenticate with XSupplicant under Linux fine, but Windows

fails

Post by matt morris

apparently with the error "Failing Auth because we got a success/fail
without TLV."

In the peap section I've tried various combinations of the
copy_request_to_tunnel and use_tunneled_reply flags to no avail -
including leaving them unspecified.

That won't work, as the code is just wrong.

Hopefully somebody can spot what is probably a silly mis-configuration
on my part!

Nope.
PEAP probably works on other systems because they don't look for the
"TLV" response code, like they're supposed to. XP does, so it fails
when the PEAP module doesn't supply the TLV.
Alan DeKok.

Hope this helps

Subject: Re: PEAP authentication very strange problem! PLEASE HELP
Date: Thu, 15 Jan 2004 09:09:34 +0100 (MET)
Anybody knows about this problem...? please help if you have an idea!!!
thanks a lot

hello everyone,
I have a very strange problem while I try to do PEAP

authentication...

Post by matt morris

I have successfully made TLS authentication, TTLS also works with

secureW2

client, but when I tried to do PEAP authentication, I have a very

strange

I am using a snaphot of freeradius from 2004/01/04 ,my supplicant is
windows XP SP1 with all patch, and when I do PEAP authentication, all

Post by matt morris

fine for freeradius : I have an access accept and MPPE received and

send

Post by matt morris

key that are printed out. all seems to be good, my AP (which is cisco

ap)

says in the log : "eap authenticated successfull = username ", the

same

Post by matt morris

message that I had when TLS and TTLS worked.
But in the same time, in Windows side, I have already the same
"wait for authentication".... and it's not really authenticated

because

Post by matt morris

it's

a problem in windows side, don't you think so?? SI it possible ti be

Post by matt morris

problem with freeradius or my AP ?? please if someone knows, help me!
Renaud Garelli
-
List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html

-
List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html

_________________________________________________________________
The new MSN 8: advanced junk mail protection and 2 months FREE*

http://join.msn.com/?page=dept/bcomm&pgmarket=en-ca&RU=http%3a%2f%2fjoin.msn.com%2f%3fpage%3dmisc%2fspecialoffers%26pgmarket%3den-ca

Post by matt morris
-
List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html

-
List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html

_________________________________________________________________
MSN 8 helps eliminate e-mail viruses. Get 2 months FREE*.
http://join.msn.com/?page=features/virus&pgmarket=en-ca&RU=http%3a%2f%2fjoin.msn.com%2f%3fpage%3dmisc%2fspecialoffers%26pgmarket%3den-ca

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Mike Saywell

2004-01-18 15:33:20 UTC

Permalink

Hmm,

I guess Windows is just caching the details, I'm not sure though.

Infact that does seem to be the case:

See http://support.microsoft.com/default.aspx?scid=kb;en-us;828996

Article 823731 contains instructions on how to remove the cache, however
it sounds like you would have to do that every time:

"There is no option that you can configure in Windows XP to prevent the
operating system from storing your credentials."

I guess you could cludge it so that the cache is removed every time the
machine boots. Or use Linux ;)

Cheers,

Mike

Post by matt morris
Hello, Mike. Just a verification: So you replaced "rcode = RLM_MODULE_OK;"
with "rcode = RLM_MODULE_HANDLED;"? I tried that and the winxp supplicant
can indeed connect successfully. However, the user was not prompted for the
username and password on subsequent reboots and can still get access to the
internet after that one successful login. Is that an expected result? (My
desired result should be the user get prompted to authenticate everytime
he/she reboots or loads up winxp in order to gain access. Is that an ip
least time problem, or a cookie/temp file problem or the modifed peap
module's problem?
TIA

Post by matt morris
I read a post from a user named Mike Saywell, stating a similar

situation

from

Post by matt morris

I can authenticate with XSupplicant under Linux fine, but Windows

fails

Post by matt morris

apparently with the error "Failing Auth because we got a success/fail
without TLV."

In the peap section I've tried various combinations of the
copy_request_to_tunnel and use_tunneled_reply flags to no avail -
including leaving them unspecified.

That won't work, as the code is just wrong.

Hopefully somebody can spot what is probably a silly mis-configuration
on my part!

Nope.
PEAP probably works on other systems because they don't look for the
"TLV" response code, like they're supposed to. XP does, so it fails
when the PEAP module doesn't supply the TLV.
Alan DeKok.

Hope this helps

Subject: Re: PEAP authentication very strange problem! PLEASE HELP
Date: Thu, 15 Jan 2004 09:09:34 +0100 (MET)
Anybody knows about this problem...? please help if you have an idea!!!
thanks a lot

hello everyone,
I have a very strange problem while I try to do PEAP

authentication...

Post by matt morris

I have successfully made TLS authentication, TTLS also works with

secureW2

client, but when I tried to do PEAP authentication, I have a very

strange

I am using a snaphot of freeradius from 2004/01/04 ,my supplicant is
windows XP SP1 with all patch, and when I do PEAP authentication, all

Post by matt morris

fine for freeradius : I have an access accept and MPPE received and

send

Post by matt morris

key that are printed out. all seems to be good, my AP (which is cisco

ap)

says in the log : "eap authenticated successfull = username ", the

same

Post by matt morris

message that I had when TLS and TTLS worked.
But in the same time, in Windows side, I have already the same
"wait for authentication".... and it's not really authenticated

because

Post by matt morris

it's

a problem in windows side, don't you think so?? SI it possible ti be

Post by matt morris

problem with freeradius or my AP ?? please if someone knows, help me!
Renaud Garelli
-
List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html

-
List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html

_________________________________________________________________
The new MSN 8: advanced junk mail protection and 2 months FREE*

http://join.msn.com/?page=dept/bcomm&pgmarket=en-ca&RU=http%3a%2f%2fjoin.msn.com%2f%3fpage%3dmisc%2fspecialoffers%26pgmarket%3den-ca

Post by matt morris
-
List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html

-
List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html

_________________________________________________________________
MSN 8 helps eliminate e-mail viruses. Get 2 months FREE*.
http://join.msn.com/?page=features/virus&pgmarket=en-ca&RU=http%3a%2f%2fjoin.msn.com%2f%3fpage%3dmisc%2fspecialoffers%26pgmarket%3den-ca
-
List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html