<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:NewsGotT;
panose-1:0 0 0 0 0 0 0 0 0 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EstiloCorreioEletrnico17
{mso-style-type:personal-compose;
font-family:NewsGotT;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 3.0cm 70.85pt 3.0cm;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="PT" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US" style="font-size:12.0pt;font-family:NewsGotT">Hi, list!<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:12.0pt;font-family:NewsGotT"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:12.0pt;font-family:NewsGotT">Here, at University of Minho, we are struggling with an issue related to re-authentication on wi-fi network eduroam, situation that only occurs on MacBooks running the most
recent OS X versions. Every time the session expires, users are prompted to insert (again) the credentials, what, actually, is not necessary since if you click ‘Cancel’ or press the ‘Esc’ key, re-authentication occurs successfully. Our infrastructure is configured
with a session timeout of 1800 seconds so, as you already guess, every 30 minutes the affected users face this ‘problem’. It also happens when devices roam to another Access Point – when in roaming, you don’t have to wait 30 minutes, you experience the problem
as soon as the device associates to another AP.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:12.0pt;font-family:NewsGotT"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:12.0pt;font-family:NewsGotT">I’ve checked the RADIUS logs and realized that the first time re-authentication occurs, the inner authentication method is no longer the one used the first time the device
connected (MSCHAPv2), using GTC instead. I managed to configure Radiator so support GTC, which, at first, seemed to have solved the problem, until I realized that the second time re-authentication occurs, the inner method has changed to MD5-Challenge – it
looks like the MacBook is trying all authentication methods it supports in a round-robin way.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:12.0pt;font-family:NewsGotT"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:12.0pt;font-family:NewsGotT">This behavior is very odd and I suppose (nearly 100% sure) that the problem is on MacBook side, but maybe some of you have already deal with it and have some kind of tip that
can help us.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:12.0pt;font-family:NewsGotT"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:12.0pt;font-family:NewsGotT">I may say that if we use a configuration profile (created with Apple Configurator 2), defined with a supported authentication method (PEAP, TTLS/PAP, TTLS/MSCHAPv2 and, most
recently, TTLS/GTC), re-authentication and roaming are transparent, the device does not prompt you to insert the credentials, and everything works just fine. If the profile is defined with the option ‘OS Default’, then the problem persists.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:12.0pt;font-family:NewsGotT"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:12.0pt;font-family:NewsGotT">We would prefer not to use the configuration profiles due to the burden it carries itself – we want our infrastructure to allow users to connect just by inserting their credentials,
what we achieved long time ago and want to keep going this way.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:12.0pt;font-family:NewsGotT"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:12.0pt;font-family:NewsGotT">I’ve been googling around and found nothing that could help me. I’ll post this message on Apple mailing lists also (which appears to be the most wise thing to do…)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:12.0pt;font-family:NewsGotT"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:NewsGotT">Best regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:NewsGotT"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:NewsGotT;color:gray;mso-fareast-language:PT">Amândio Antunes Gomes da Silva<o:p></o:p></span></b></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:NewsGotT;color:gray;mso-fareast-language:PT">-----------------------------------------------------------------------------------------------------------------------------------<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:NewsGotT;color:gray;mso-fareast-language:PT">Serviços de Comunicações da Universidade do Minho</span><span style="font-size:8.0pt;font-family:NewsGotT;color:navy;mso-fareast-language:PT"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:NewsGotT;color:gray;mso-fareast-language:PT">Campus de Gualtar, 4710-057 Braga - Portugal</span><span style="font-size:8.0pt;font-family:NewsGotT;color:navy;mso-fareast-language:PT"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:NewsGotT;color:gray;mso-fareast-language:PT">Tel.: + 351 253 60 40 20, Fax: +351 253 60 40 21<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:8.0pt;font-family:NewsGotT;color:gray;mso-fareast-language:PT">email:
<a href="mailto:amandio@scom.uminho.pt"><span style="color:blue">amandio@scom.uminho.pt</span></a> |
<a href="http://www.scom.uminho.pt/"><span style="color:blue">http://www.scom.uminho.pt</span></a></span><span lang="EN-US" style="font-size:8.0pt;font-family:NewsGotT;mso-fareast-language:PT"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:8.0pt;font-family:NewsGotT;color:gray;mso-fareast-language:PT">-----------------------------------------------------------------------------------------------------------------------------------<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:8.0pt;font-family:NewsGotT;color:gray;mso-fareast-language:PT">This email is confidential. If you are not the intended recipient,
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:8.0pt;font-family:NewsGotT;color:gray;mso-fareast-language:PT">you must not disclose or use the information contained in it.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:8.0pt;font-family:NewsGotT;color:gray;mso-fareast-language:PT">If you have received this mail in error, please tell us immediately
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:8.0pt;font-family:NewsGotT;color:gray;mso-fareast-language:PT">by return email and delete the document.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:NewsGotT;color:gray;mso-fareast-language:PT">--<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:NewsGotT;color:gray;mso-fareast-language:PT">Este email é confidêncial. Se não é o destinatário do mesmo,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:NewsGotT;color:gray;mso-fareast-language:PT">não deve nem revelar, nem usar o seu conteúdo.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:NewsGotT;color:gray;mso-fareast-language:PT">Se recebeu esta mensagem por engano, por favor informe-nos<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:NewsGotT;color:gray;mso-fareast-language:PT">Imediatamente, devolvendo e apagando este email.<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>