Bug 1060319

Created attachment 857954 [details]
patch to fix inability of use "windows credentials" to login

Description of problem:
In scenarios where freeradius server is used as MSCHAP authenticator for EAP-PEAP/EAP-MSCHAPv2/MSCHAPv2 authentication methods (for WLAN/LAN/VPN authentication) the account verification is failing if end-users are trying to use "Automatically use my Windows logon name" within the authentication tab of the connection properties. In cases where users provides their credentials directly during the connection establishment, the authentication is working correctly.

This behavior is considered as bug in this version of freeradius server and specific fix was provided (in upstream) to overcome this inability - https://github.com/FreeRADIUS/freeradius-server/commit/15e0d23c8a3a82cfadd2e5ec8292fd6af983aaa6
I have created a patch from this commit to the distribution version of freeradius and I have tested it successfully. 


Version-Release number of selected component (if applicable):
freeradius-2.1.12-4.el6_3.x86_64

How reproducible:
always


Actual results:
[mschapv2] # Executing group from file /etc/raddb/sites-enabled/inner-tunnel
[mschapv2] +- entering group MS-CHAP {...}
[mschapv2] ++? if ("%{My-Local-Client-Type}" == "user")
[mschapv2] expand: %{My-Local-Client-Type} -> user
[mschapv2] ? Evaluating ("%{My-Local-Client-Type}" == "user") -> TRUE
[mschapv2] ++? if ("%{My-Local-Client-Type}" == "user") -> TRUE
[mschapv2] ++- entering if ("%{My-Local-Client-Type}" == "user") {...}
[mschap] ERROR: User-Name (abrakadabra\bob) is not the same as MS-CHAP Name (bob) from EAP-MSCHAPv2
+++[mschap] returns reject
++- if ("%{My-Local-Client-Type}" == "user") returns reject
[eap] Freeing handler
++[eap] returns reject
Failed to authenticate the user.
Login incorrect: [abrakadabra\\bob] (from client vpn.exmaple.org port 0 via TLS tunnel) 

Expected results:
mentioned error "ERROR: User-Name (abrakadabra\bob) is not the same as MS-CHAP Name (bob) from EAP-MSCHAPv2" was reclassified as WARNING without rejecting whole request and authentication will continue with final verification.