Bug 1060319 - MSCHAP Authentication is not working using automatic windows user credentials.
Summary: MSCHAP Authentication is not working using automatic windows user credentials.
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: freeradius
Version: 6.5
Hardware: All
OS: Linux
Target Milestone: rc
: ---
Assignee: Nikolai Kondrashov
QA Contact: Jaroslav Aster
Depends On:
Blocks: 1061410
TreeView+ depends on / blocked
Reported: 2014-01-31 19:02 UTC by Michal Bruncko
Modified: 2015-07-22 06:16 UTC (History)
4 users (show)

Fixed In Version: freeradius-2.2.6-1.el6
Doc Type: Bug Fix
Doc Text:
MS-CHAP authentication failed when the User-Name and MS-CHAP-User-Name attributes used different encodings, even when the user provided correct credentials. Now, MS-CHAP authentication properly handles mismatching character encodings. Authentication with correct credentials no longer fails in this situation.
Clone Of:
Last Closed: 2015-07-22 06:16:40 UTC

Attachments (Terms of Use)
patch to fix inability of use "windows credentials" to login (2.30 KB, patch)
2014-01-31 19:02 UTC, Michal Bruncko
no flags Details | Diff

System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2015:1287 normal SHIPPED_LIVE Moderate: freeradius security, bug fix, and enhancement update 2015-07-20 17:48:53 UTC

Description Michal Bruncko 2014-01-31 19:02:19 UTC
Created attachment 857954 [details]
patch to fix inability of use "windows credentials" to login

Description of problem:
In scenarios where freeradius server is used as MSCHAP authenticator for EAP-PEAP/EAP-MSCHAPv2/MSCHAPv2 authentication methods (for WLAN/LAN/VPN authentication) the account verification is failing if end-users are trying to use "Automatically use my Windows logon name" within the authentication tab of the connection properties. In cases where users provides their credentials directly during the connection establishment, the authentication is working correctly.

This behavior is considered as bug in this version of freeradius server and specific fix was provided (in upstream) to overcome this inability - https://github.com/FreeRADIUS/freeradius-server/commit/15e0d23c8a3a82cfadd2e5ec8292fd6af983aaa6
I have created a patch from this commit to the distribution version of freeradius and I have tested it successfully. 

Version-Release number of selected component (if applicable):

How reproducible:

Actual results:
[mschapv2] # Executing group from file /etc/raddb/sites-enabled/inner-tunnel
[mschapv2] +- entering group MS-CHAP {...}
[mschapv2] ++? if ("%{My-Local-Client-Type}" == "user")
[mschapv2] expand: %{My-Local-Client-Type} -> user
[mschapv2] ? Evaluating ("%{My-Local-Client-Type}" == "user") -> TRUE
[mschapv2] ++? if ("%{My-Local-Client-Type}" == "user") -> TRUE
[mschapv2] ++- entering if ("%{My-Local-Client-Type}" == "user") {...}
[mschap] ERROR: User-Name (abrakadabra\bob) is not the same as MS-CHAP Name (bob) from EAP-MSCHAPv2
+++[mschap] returns reject
++- if ("%{My-Local-Client-Type}" == "user") returns reject
[eap] Freeing handler
++[eap] returns reject
Failed to authenticate the user.
Login incorrect: [abrakadabra\\bob] (from client vpn.exmaple.org port 0 via TLS tunnel) 

Expected results:
mentioned error "ERROR: User-Name (abrakadabra\bob) is not the same as MS-CHAP Name (bob) from EAP-MSCHAPv2" was reclassified as WARNING without rejecting whole request and authentication will continue with final verification.

Comment 2 Dmitri Pal 2014-03-14 21:44:00 UTC
Not on ACL for 6.6. Moving out.

Comment 11 errata-xmlrpc 2015-07-22 06:16:40 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.