Hi,
Trying to setting up a radius access to CLI on VOSS devices, LDAP/Bind authentication process on an AD works fine when using an attribute without domain name extension, e.g. firstname.lastname (here "uid" for user search attribute, with entry like "john.doe"):
![dd7f7ecbf5e54d508016ad7f44312749.png dd7f7ecbf5e54d508016ad7f44312749.png](/t5/image/serverpage/image-id/2059iAD1D7DC95FC8185B/image-size/large?v=v2&px=999)
Connection failed if changing the bind attribute to an another (here "userPrincipalName") where login uses domain name extension, e.g. john.doe@domain.lan, which is the normal login format in my entity:
![ac2a021ebf96432a87423262c85913c8.png ac2a021ebf96432a87423262c85913c8.png](/t5/image/serverpage/image-id/5173iA1F45EEA3531CB28/image-size/large?v=v2&px=999)
Capturing radius traffic on AD controller, I can see that:
* first request searching for the user's groups membership with domain name extension is correctly done with domain extension, and AD response is ok:
![6012497ef56a44ba91e40c0892f5b4f8.png 6012497ef56a44ba91e40c0892f5b4f8.png](/t5/image/serverpage/image-id/42i2A2EDAC90E8BB8B6/image-size/large?v=v2&px=999)
* second request for bind authentication failed because NAC gw now try to do it without domain extension:
![49a6e82233cf4602a54151ca3fc2f159.png 49a6e82233cf4602a54151ca3fc2f159.png](/t5/image/serverpage/image-id/2408i996E4072FEB41041/image-size/large?v=v2&px=999)
Any idea ?
Rodjeur