cancel
Showing results for 
Search instead for 
Did you mean: 

Problem with Radius authentication for accounts with domain name extension

Problem with Radius authentication for accounts with domain name extension

Jave
Contributor
Hi,

Trying to setting up a radius access to CLI on VOSS devices, LDAP/Bind authentication process on an AD works fine when using an attribute without domain name extension, e.g. firstname.lastname (here "uid" for user search attribute, with entry like "john.doe"):

dd7f7ecbf5e54d508016ad7f44312749.png

Connection failed if changing the bind attribute to an another (here "userPrincipalName") where login uses domain name extension, e.g. john.doe@domain.lan, which is the normal login format in my entity:

ac2a021ebf96432a87423262c85913c8.png
Capturing radius traffic on AD controller, I can see that:
* first request searching for the user's groups membership with domain name extension is correctly done with domain extension, and AD response is ok:

6012497ef56a44ba91e40c0892f5b4f8.png
* second request for bind authentication failed because NAC gw now try to do it without domain extension:

49a6e82233cf4602a54151ca3fc2f159.png
Any idea ?

Rodjeur
0 REPLIES 0
GTM-P2G8KFN