Bug 1155045
| Summary: | Wireless WPA2 Enterprise Network asks 2 times for Password with OTP enabled | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Oliver Ilian <oliver> | ||||||
| Component: | NetworkManager | Assignee: | Dan Williams <dcbw> | ||||||
| Status: | CLOSED INSUFFICIENT_DATA | QA Contact: | Desktop QE <desktop-qa-list> | ||||||
| Severity: | medium | Docs Contact: | |||||||
| Priority: | medium | ||||||||
| Version: | 7.0 | CC: | bgalvani, danw, dcbw, kzhang, lrintel, oliver, rkhan, thaller, vbenes | ||||||
| Target Milestone: | rc | ||||||||
| Target Release: | --- | ||||||||
| Hardware: | Unspecified | ||||||||
| OS: | Unspecified | ||||||||
| Whiteboard: | |||||||||
| Fixed In Version: | Doc Type: | Bug Fix | |||||||
| Doc Text: | Story Points: | --- | |||||||
| Clone Of: | Environment: | ||||||||
| Last Closed: | 2016-01-04 23:22:03 UTC | Type: | Bug | ||||||
| Regression: | --- | Mount Type: | --- | ||||||
| Documentation: | --- | CRM: | |||||||
| Verified Versions: | Category: | --- | |||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||
| Embargoed: | |||||||||
| Attachments: |
|
||||||||
|
Description
Oliver Ilian
2014-10-21 10:15:48 UTC
Created attachment 949274 [details]
/var/log/wpa_supplicant.log
Created attachment 949275 [details]
/var/log/messages
Status code 12 is "Association denied due to reason outside the scope of this standard" which is completely unhelpful. Sometimes this is due to the AP system load-balancing clients between APs; eg it will reject assocations on a loaded AP hoping that the client will re-associate to another AP. Unfortunately that re-association may require a full reauthentication because you haven't successfully authenticated at least once yet. In Oliver's case it is: Oct 22 09:50:13 ohaessle kernel: wlp3s0: deauthenticated from 00:24:f7:bf:49:90 (Reason: 3) Reason 3 is "Deauthenticated because sending STA is leaving (or has left) IBSS or ESS", which doesn't say much about the error. The AP is simply rejecting your authentication attempt. We *might* be able to use the disconnect reason codes to be smarter about asking for secrets, but that's somewhat hard because there isn't a lot of consistency between AP implementations about when they are used. Hi. Do we have any news on this bug? My users are starting to get quiet annoyed for having to always type the wireless token twice. If there is any information missing, please let me know. Actually, if we could get more detailed supplicant debugging information when this happens, that would help. Could you: 1) mv /usr/sbin/wpa_supplicant / 2) killall -TERM wpa_supplicant 3) /wpa_supplicant -dddtu (redirect to a logfile somewhere) 4) NM should attempt to reconnect; when you have experienced the failure, attach the supplicant log output here. Also, 'dmesg' output over the failure time would be useful. Next up, is there any way you can get the access point or RADIUS logs from these failures? That can often help pinpoint why the AP is rejecting the association, especially with status/reason codes that are not 3. I am trying to reproduce it, but it is a hit and miss.. as soon as I have the log files, I will share them here. Not sure I can get the RADIUS logs from the AP's. Any luck reproducing the issue and getting logs? Closing for now; please re-open if you're able to reproduce the issue and get the logs I requested earlier. Thanks! |