<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
For some reason this is not working. AD always thinks that the credentials are wrong. Debug shows:</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Tue Mar 8 11:09:51 2022: DEBUG: Handling request with Handler 'ConvertedFromEAPMSCHAPV2=1, User-Name=/^[^@]+(@uic\.edu)?(@uic\.wireless)?\z/i', Identifier ''<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Tue Mar 8 11:09:51 2022: DEBUG: Rewrote user name to NETID<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
...</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Tue Mar 8 11:09:51 2022: DEBUG: Handling with Radius::AuthNTLM:<br>
Tue Mar 8 11:09:51 2022: DEBUG: Radius::AuthNTLM looks for match with NETID [NETID@uic.edu]<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
...</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Tue Mar 8 11:09:51 2022: DEBUG: Received attribute: Authenticated: No
<div>Tue Mar 8 11:09:51 2022: DEBUG: Received attribute: Authentication-Error: When trying to update a password, this return status indicates that the value provided as the current password is not correct.</div>
<div>Tue Mar 8 11:09:51 2022: DEBUG: Received attribute: .</div>
<div>Tue Mar 8 11:09:51 2022: WARNING: NTLM Could not authenticate user 'NETID': When trying to update a password, this return status indicates that the value provided as the current password is not correct.</div>
<div>Tue Mar 8 11:09:51 2022: DEBUG: Radius::AuthNTLM REJECT: AuthBy NTLM Password check failed: NETID [NETID@uic.edu]</div>
<div>Tue Mar 8 11:09:51 2022: DEBUG: AuthBy NTLM result: REJECT, AuthBy NTLM Password check failed</div>
<div>Tue Mar 8 11:09:51 2022: INFO: Access rejected for NETID: AuthBy NTLM Password check failed</div>
Tue Mar 8 11:09:51 2022: DEBUG: Converted EAP-MSCHAPV2 response Packet dump:<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I need to get on-site to do some more debugging but does anyone have any ideas? Is ntlm_auth messing up somewhere? Is the problem related to a PEAP tunnel? AD confirms incorrect credentials but that's not the case. If we just do a simple thing like this:</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<Handler ConvertedFromEAPMSCHAPV2=1><br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
...</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<AuthBy NTLM>
<div> UsernameMatchesWithoutRealm</div>
<div> DefaultDomain AD</div>
</AuthBy><br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Everything works just fine.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
One thing I don't understand is that just before that section in the debug log we have:</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Tue Mar 8 11:09:51 2022: DEBUG: Handling request with Handler 'TunnelledByPEAP=1', Identifier ''
<div>Tue Mar 8 11:09:51 2022: DEBUG: Rewrote user name to NETID@uic.edu@uic.wireless</div>
<div>Tue Mar 8 11:09:51 2022: DEBUG: Rewrote user name to NETID@uic.edu@uic.wireless</div>
Tue Mar 8 11:09:51 2022: DEBUG: Rewrote user name to NETID@uic.edu@uic.wireless<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I don't understand this PEAP tunnel section and maybe that's part of the problem.</div>
<div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature">
<div>
<div></div>
<div id="divtagdefaultwrapper" style="font-size:12pt; color:#000000; background-color:#FFFFFF; font-family:Calibri,Arial,Helvetica,sans-serif">
<div style="font-family:Tahoma; font-size:13px">---
<div><span id="ms-rterangepaste-start"></span><span style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">Roberto Ullfig - rullfig@uic.edu</span><br style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">Systems Administrator</span><br style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">Enterprise Applications & Services | Technology Solutions</span><br style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">University of Illinois - Chicago</span>
<div><span id="ms-rterangepaste-end"></span></div>
</div>
</div>
</div>
</div>
</div>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> radiator <radiator-bounces@lists.open.com.au> on behalf of Heikki Vatiainen <hvn@open.com.au><br>
<b>Sent:</b> Thursday, February 24, 2022 3:44 PM<br>
<b>To:</b> radiator@lists.open.com.au <radiator@lists.open.com.au><br>
<b>Subject:</b> Re: [RADIATOR] Simple Question Regarding Realm Handling</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">On 23.2.2022 23.27, Ullfig, Roberto Alfredo wrote:<br>
<br>
> Wed Feb 23 15:03:55 2022: DEBUG: Radius::AuthNTLM REJECT: AuthBy NTLM <br>
> Password check failed: user [user@uic.edu]<br>
> Wed Feb 23 15:03:55 2022: DEBUG: AuthBy NTLM result: REJECT, AuthBy NTLM <br>
> Password check failed<br>
> <br>
> To AD it looks like a wrong password was entered. Why do the NTLM lines <br>
> have "user [user@uic.edu]" - why not just user?<br>
The format is 'value used for authenticating [original username]'. For <br>
example, if username is rewritten, or something else, such as <br>
Calling-Station-Id attribute value, is used to lookup user record, that <br>
value gets logged first.<br>
<br>
What follows between [] is the original User-Name as it was received.<br>
<br>
The idea is to log information about what's currently used and what was <br>
originally received as User-Name.<br>
<br>
In your example, 'user' is passed to NTLM subsystem as authentication <br>
username instead of 'user@uic.edu' that was the value in the incoming <br>
request.<br>
<br>
Thanks,<br>
Heikki<br>
<br>
-- <br>
Heikki Vatiainen <hvn@open.com.au><br>
<br>
Radiator: the most portable, flexible and configurable RADIUS server<br>
anywhere. SQL, proxy, DBM, files, LDAP, TACACS+, PAM, Active Directory,<br>
EAP, TLS, TTLS, PEAP, WiMAX, RSA, Vasco, Yubikey, HOTP, TOTP,<br>
DIAMETER etc. Full source on Unix, Windows, MacOSX, Solaris, VMS, etc.<br>
_______________________________________________<br>
radiator mailing list<br>
radiator@lists.open.com.au<br>
<a href="https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.open.com.au%2Fmailman%2Flistinfo%2Fradiator&data=04%7C01%7Crullfig%40uic.edu%7C4ef1ec34e13c470f64ed08d9f7df063e%7Ce202cd477a564baa99e3e3b71a7c77dd%7C0%7C0%7C637813359530383653%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000&sdata=s6i5L10CBaCCZDiLZQwlYvCH2ukDM0chu8E%2BGapD8ok%3D&reserved=0">https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.open.com.au%2Fmailman%2Flistinfo%2Fradiator&data=04%7C01%7Crullfig%40uic.edu%7C4ef1ec34e13c470f64ed08d9f7df063e%7Ce202cd477a564baa99e3e3b71a7c77dd%7C0%7C0%7C637813359530383653%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000&sdata=s6i5L10CBaCCZDiLZQwlYvCH2ukDM0chu8E%2BGapD8ok%3D&reserved=0</a><br>
</div>
</span></font></div>
</body>
</html>