<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="en-NL" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US">Hi,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Last week I’ve changed our configuration <o:p>
</o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">From this<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <AuthBy LSA><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> EAPType MSCHAP-V2<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> DefaultDomain somedomain<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> UsernameMatchesWithoutRealm<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> Group wireless-lumc-0<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> Group wireless-lumc-1<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> Group wireless-lumc-2<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> Group wireless-lumc-3<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> Group wireless-lumc-4<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> Group wireless-lumc-sa<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> Group wireless-lumc-other
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> Group Domain Computers <o:p>
</o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> </AuthBy><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">To <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <AuthBy LSA><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> EAPType MSCHAP-V2<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> DefaultDomain somedomain<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> UsernameMatchesWithoutRealm<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> Group wireless-lumc<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> Group wireless-lumc-sa<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> Group wireless-lumc-other<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> Group Domain Computers
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> </AuthBy><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Initially it works fine, however after several hours (random, fist time it took 12 hours, then we’ve also had it happen 3x within 12 hours) the AuthBy LSA module is unable to authenticate users.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Suddenly the logfiles are filled with entries that users trying to log in are not a member of any group.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Sat Jun 1 13:53:15 2019: DEBUG: Radius::AuthLSA looks for match with accountname [accountname@lumc.nl]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Sat Jun 1 13:53:15 2019: DEBUG: Checking LSA Group membership for \\DomainController, wireless-lumc, accountname<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Sat Jun 1 13:53:15 2019: DEBUG: Checking LSA Group membership for \\DomainController, wireless-lumc-sa, accountname<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Sat Jun 1 13:53:15 2019: DEBUG: Checking LSA Group membership for \\DomainController, wireless-lumc-other, accountname<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Sat Jun 1 13:53:15 2019: DEBUG: Checking LSA Group membership for \\DomainController, Domain Computers, accountname<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Sat Jun 1 13:53:15 2019: DEBUG: Radius::AuthLSA REJECT: AuthBy LSA User is not a member of any Group: accountname [accountname@lumc.nl]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">The “wireless-lumc” AD group, in this example, contains all users accounts that are able to authenticate (about 14500 accounts)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">I wanted to phase out some AD groups in favor of a single AD group, but at this time that’s not an option due to the large business impact if our entire wireless goes down at random.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Is there a known limit of members that an AD group may have (from a Radiator perspective)?<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Kind regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Stephan Schwarz<o:p></o:p></span></p>
</div>
</body>
</html>