1200 AP and Proxy authentication?

Hello,
I currently have radius (Linux FreeRadius) working to authenticate admin access to the AP.
Is it possible to authenticate user web requests through the 1200 AP using a radius server and the stock IOS? The current version is Version 12.2(13).
I am setting up a hotspot for my office and want users to authenticate via radius before accessing the net.

We can use virtual http (or telnet)
All traffic from inside to outside on port 80 will be blocked by default.
Users will have to http (or telnet) to a virtual ip and after authentication, a access-list will be downloaded from the radius server allowing traffic on port 80.
Cut-through proxy (as in PIX) cannot be done on IOS.

Similar Messages

IAS 9i, JAAS and Proxy Authentication

Hi
I'm trying to use proxy authentication for a web application hosted on IAS. The 'Oracle 9i Application Server Security guide' states that proxy authentication is supported using JDBC, but I can't find instructions on how to use this approach. Is this feature configurable, or it must be hand coded in the web application.
Ideally, I'd like to establish the lightweight session using the credentials used to perform a JAAS authentication.
I've seen an example for a similar situation linking JAAS authentication to VPDs setting up the application context for the database connection, but the example was tied to BC4J. I'd like to use a more general approach, for example to use this feature with BI Beans.
I think this is not an unusual setup, but I can't find clear instructions on how to make the pieces work together.
Fernando

Thanks,
Any additional recommendations are welcome. We plan to use forms and reports service with SSL.

Softwareupdate Tool and Proxy Authentication

Is there a method for negotiating proxy authentication when using the softwareupdate tool. I may want to to connect to Apple's servers on the internet from time to time.
Our proxy is a BlueCoat SG800 with software v4.2. It prompts for authentication for port 80 requests.
Thanks.

Monday I used softwareupdate tool to get the update list for my eMac.
This is cool. It asked for permission to use my internet keychain! In a few minutes I got the list and updated my QuickTime.
This only works in Tiger. Panther will not prompt for authentication.
So I answered my own question.

Is there an issue with the latest version of FF with HTTPS requests and Proxy authentication?

I'm currently working inside a cope network behind a proxy, which requires authentication.
When browsing to websites externally to our network I would usually only be promoted once for authentication details; after that I would never see the prompt again until after restating the browser.
However after the latest update I've found that when visiting HTTPS sites I'm promoted for my login details. But even though I enter the correct information the prompt does not take the details and continually asks until eventually our proxy closes the connection (usually with my account now being locked).
My other browsers (IE, GC) work fine without problems.
Any ideas?

It could be a regression in Firefox 18 that wasn't present in Firefox 17. The developers are known nowadays for including too many experimental changes and my bet is one of them is causing this.
But to confirm, could you downgrade back to Firefox 17 and still see if it works well with proxy authentication?
Download link:
<br> www.mozilla.org/en-US/products/download.html?product=firefox-17.0.1&os=win&lang=en-US

1200 AP and IAS authentication

I am just trying to verify that a Cisco access point will not allow windows clients to authenticate to a Microsoft IAS server without using a certificate. It looks as if you have two choices PEAP and SmartCard/Digital Certificate and that is it, am I correct?

The AP itself doesn't actually care about the protocols - it approves the authentication based on the instructions of the radius server, in your case IAS. You are correct, in that when using IAS and the built-in supplicant on windows your only choices are essentially EAP-TLS and EAP-PEAP.
Since the 802.1x authentication itself isn't encrypted or protected, its up to the EAP protocols to build in credential and privacy protections to its authentication method - the easiest way to do this is with certificate-based methods.
- mike

My app store is not working after installing mavericks. When I open app store it repeatedly asking me to login with apple ID and to provide User name and Password for proxy authentication in a loop.I am a newbie to mac,Please help me.

My app store is not working after installing mavericks. When I open app store it repeatedly asking me to login with apple ID and to provide User name and Password for proxy authentication in a loop.I am a newbie to mac,Please help me.

Hmmmm... would appear that you need to be actually logged in to enable the additional menu features.
Have you tried deletting the plists for MAS?
This page might help you out...
http://www.macobserver.com/tmo/answers/how_to_identify_and_fix_problems_with_the _mac_app_store
Failing that, I will have to throw this back to the forum to see if anyone else can advise further.
Let me know how you get on?
Thanks.

WWSAPI - Cannot connect to web service via SSL and HTTP proxy authentication with NTLM, errorCode 0x803d0016, HTTP status 407

Hi,
I built a web service client using WWSAPI. The connection works via SSL (without HTTP proxy) and it works with SSL and proxy with basic authentication as well. When I try to connect using a proxy with NTLM authentication, then I get the errorCode
0x803d0016, HTTP status "407 (0x197)", "Proxy Authentication Required".
In WireShark I see only one HTTP request to connect to the proxy with NTLM Message Type: NTLMSSP_NEGOTIATE. The HTTP Response returns Status 407 and the connection ist closed. Comparing this to Internet Explorer - the Connection is not closed and
a second request with NTLMSSP_AUTH is sent.
Why doesn't it make the complete NTLM handshake? Why wasn't sent the NTLMSSP_AUTH directly?
I oriented in the HttpCalculatorWithKerberosOverSslClientExample.
Using WS_HTTP_HEADER_AUTH_SECURITY_BINDING,
WS_SECURITY_BINDING_PROPERTY_HTTP_HEADER_AUTH_SCHEME was set to WS_HTTP_HEADER_AUTH_SCHEME_NTLM, WS_SECURITY_BINDING_PROPERTY_HTTP_HEADER_AUTH_TARGET to WS_HTTP_HEADER_AUTH_TARGET_PROXY. I tried WS_DEFAULT_WINDOWS_INTEGRATED_AUTH_CREDENTIAL_TYPE but also WS_STRING_WINDOWS_INTEGRATED_AUTH_CREDENTIAL_TYPE.
Any idea?
Thanks

Hi,
I built a web service client using WWSAPI. The connection works via SSL (without HTTP proxy) and it works with SSL and proxy with basic authentication as well. When I try to connect using a proxy with NTLM authentication, then I get the errorCode
0x803d0016, HTTP status "407 (0x197)", "Proxy Authentication Required".
In WireShark I see only one HTTP request to connect to the proxy with NTLM Message Type: NTLMSSP_NEGOTIATE. The HTTP Response returns Status 407 and the connection ist closed. Comparing this to Internet Explorer - the Connection is not closed and
a second request with NTLMSSP_AUTH is sent.
Why doesn't it make the complete NTLM handshake? Why wasn't sent the NTLMSSP_AUTH directly?
I oriented in the HttpCalculatorWithKerberosOverSslClientExample.
Using WS_HTTP_HEADER_AUTH_SECURITY_BINDING,
WS_SECURITY_BINDING_PROPERTY_HTTP_HEADER_AUTH_SCHEME was set to WS_HTTP_HEADER_AUTH_SCHEME_NTLM, WS_SECURITY_BINDING_PROPERTY_HTTP_HEADER_AUTH_TARGET to WS_HTTP_HEADER_AUTH_TARGET_PROXY. I tried WS_DEFAULT_WINDOWS_INTEGRATED_AUTH_CREDENTIAL_TYPE but also WS_STRING_WINDOWS_INTEGRATED_AUTH_CREDENTIAL_TYPE.
Any idea?
Thanks

Safari, Proxy Authentication, and Certificate Authorities ( for https )

A recent update to Safari has caused it to not work with our proxy authentication. It will not provide authentication details when looking up SSL certificate authorities, causing certificate errors on all https:// websites. All other traffic (http, https if certificate is bypassed, plugins, etc.) seem to work just fine. Is anyone else having this problem? If so, is there a fix?
It occurs on Mac and PC. I am using SquidGuard with NTLM authentication. All other browsers on our system (IE x.x, FireFox, Chrome, Opera ) don't have this issue.

I have the same problem and it's frustrating as can be.
What happens to me is that When I bring my laptop to work, and put it on the work network and launch Safari, Safari informs me that each of my plugins is invalid and then uninstalls them - I'm effectively not able to use any plug ins at work, and I have to go hunt them down when I get back home (for reference, The extensions are still physically in \users\me\Library\Safari\Extensions - so when I get home I can just double click on all of them)
I opened a case with apple and I encourage you to do the same. Perhaps if enough users complain they will find a gentler way to work with it.
They had me do a capture and after analyzing it said it was an issue with the work network and not being able to valdate the extensions.
It sounds like the same issue you have - as my work network uses a proxy as well.
The rep suggested that I use a different browser at work, but I'm so used to clicking safari, that I do it out of habit.
I really like Safari, and hope they get it fixed - Safari may not get respect in the windows world, but it's really a great browser - especially on a laptop where screen real estate is limited (where I often hit command-shift-\ to hide the address bar to see more of the page)
-Jack

TL 11g: JPA and DB proxy authentication?

Hi!
I posted similar question of JDev 11g forum, but I hope I can get more profound expertise here :)))
OK. I want to make a proof-of-concept for end-to-end security using a novel 11g technology: I want to use EJB 3.0 / JPA (TopLink) and to enable subject identity propagation to database using Proxy Authentication mechanism. I stress that I want to use JPA (annotated entities) and not TopLink mappings, and to have as simplest as possible code (yes, I know...).
Now, my idea is to use Session Event Listener (registered in persistance.xml) to set a proxy connection inside a standard unit of work connection defined in persistance.xml (in the proxy connection I would not set username/password in event listener as I want to do that inside EJB Session Facade).
Then, in EJB Session Fascade I would like to set a username/password for database login in session that will be used to execute a JPA transaction. I discovered that I can get a ServerSession and Active Session from Entity Manager, with:
EntityManager em = emf.createEntityManager();
ServerSession serverSession = ((oracle.toplink.jpa.JpaEntityManager)em).getServerSession();
Session activeJPASession = ((oracle.toplink.jpa.JpaEntityManager)em).getActiveSession();What I don't know is how to proceed. Do I have to use Server Session to create/open a new Client Session (but, I'm not sure if then I also have to use a manual transactions inside EBJ Session Bean method, or I can rely on container managed transaction?)? Or I can just set username/password on Active Session. Or I can change a DatabaseLogin (ActiveSession.getLogin().setUsername().setPassword())?
Please, any advice is appreciated. I'm not an expert on JPA/TopLink so I may spend days figuring this out...
Thanks in advance!
PaKo

PaKo,
We need to make proxy authentication easier through the JPA interface. At present you can configure the event listener using the toplink.session-event-listener to implement the proxy events as described in the documentation. The piece that is missing is the ability to pass in the proxy authentication credentials when acquiring an EntityManager.
You are correct that you would need to acquire a client session directly (Note: the JpaHelper can help). When acquired you can use this client session to access the database but it will function only as TopLink's native API and not completely as JPA.
I filed bug 219434 against EclipseLink to address passing the credentials into:
EntityManagerFactory.createEntityManager(Map properties)I will continue to investigate to get you a better solution.
Doug

DAP and http proxy authentication

I have a ASA firewall with http proxy authetication and now i configure DAP for Anyconnect with AD .I disable the "Default Dynamic Access Policy" proxy authentication fail .Someone knows how to configure the DAP for http proxy authentication ?
best regards

Still nothing about it. I've also posted to another threads with similar problems:
http://discussions.apple.com/message.jspa?messageID=8165122#8165122
http://discussions.apple.com/message.jspa?messageID=8165120#8165120
http://discussions.apple.com/message.jspa?messageID=8165118#8165118
http://discussions.apple.com/message.jspa?messageID=8149758#8149758
As I said before, while I've had OS 1.1.4, everything was normal. It began when I upgraded to 2.0.2 and after to 2.1. I also double checked if the TI here changed the policies, and they assured me they don't.
Several other users with 2.x are also reporting the same trouble. As far as now, I've came across a post suggesting me to install a local http proxy on the phone, but I don't think it's gonna work.
Let's keep this thread alive!

Define Reverse Proxy and Deffered Authentication Schema

Hi Experts,
Can some one help me with the Definition for "*Reverse Proxy in OAM*" and "Deffered Authentication Schema (*DAS*) in Directory server". And please quote one example for understanding.......
Thanks in Advance.
Sandy
Edited by: sandyb4u on Oct 11, 2010 1:34 AM

Hello Markus,
1. have you checked out Alon Weinstein's Weblog <a href="/people/sap.user72/blog/2005/02/23/the-reverse-proxy-series--part-2-iis-as-a-reverse-proxy">The Reverse Proxy Series -- Part 2: IIS as a reverse-proxy</a>?
2. Is the IIS a must? Can you give Apache or SAP Web Dispatcher a try. Prakash Singh wrote a Weblog <a href="/people/prakash.singh4/blog/2005/08/16/how-to-setup-webdispatcher-to-load-balance-portal-in-a-clustered-environment">How to setup webdispatcher to load balance portal in a clustered environment</a>.
Regards
Gregor

Oracle Proxy Authentication and WLS 8.1/CMP

Hey folks,
Is there any way to configure WLS 8.1 to automatically set the Oracle CLIENT_IDENTIFIER
variable or use Oracle Proxy Authentication on JDBC connections? I'm interested
in using Oracle auditing with my CMP entity beans, but would like to capture the
app tier user identity, instead of the data source pool user.
Thanks.

"Brent Smith" <[email protected]> wrote in message
news:3fa15807$[email protected]..
>
Hey folks,
Is there any way to configure WLS 8.1 to automatically set the OracleCLIENT_IDENTIFIER
variable or use Oracle Proxy Authentication on JDBC connections? I'minterested
in using Oracle auditing with my CMP entity beans, but would like tocapture the
app tier user identity, instead of the data source pool user.
I would ask in the weblogic.developer.interest.jdbc newsgroup.

I get proxy authentication box during installation and when i provide the proxy user and pass, it do not accept it and i can not go on whit the installation? any solution for that?

i need a solution for a proxy authentication error

Alyafeim please request your I.T. department review the Adobe Creative Cloud Service Access Documentation for IT section of http://www.adobe.com/devnet/creativesuite/enterprisedeployment.html

Mac Adobe Flash Player not supporting Web Proxy Authentication

Anyone else got an enterprise network where you use web proxies with web authentication and no traffic allowed out except through the proxies?
You may need to be in the UK for this, but try accessing BBC iPlayer content - http://www.bbc.co.uk/iplayer and you should discover that the content won't play. the error says "This content doesn't seem to be working. Try again later.". The content will never work as the Mac version of Flash (currently 10.1.53.64) is not able to respond to web proxy authentication requests. The BBC use various streaming server which are randomly selected when a user starts a stream and they have no DNS. Just IP addresses. They don't publish a list for security reasons. So it is almost impossible to exempt all their servers from authentication.
I've logged a bug with Adobe. If you have this issue too, please add a comment and vote so that they can begin to grasp the impact of this problem:
https://bugs.adobe.com/jira/browse/FP-5161

I have the same issues in Australia trying to access flash content from the ABC website. The strange thing is the content will play if your leave the browser open for 5min.
After several packet data captures we identified that it has to do with the amount of time it takes the Mac timeout from the proxy before it plays the video content.
No solution yet.

ITunes 10.6 and proxy server connection

Hello,
I was using iTunes, in a network enviroment with a proxy server, since yesterday when I updated it to 10.6 version.
Troubles began...
My IE settings about proxy server are correct, and my network admin did not change anything in out proxy configuration. Thus, I checked IE proxy settings, and they are ok (http://support.apple.com/kb/TS1470). Restared my PC, but iTunes after the login to my proxy server (NOT with appleid of course but with my network account - and it's works, I'm sure about it) cannot go on, with a 12002 error.
So, IMHO iTunes 10.6 proxy support is broken...

Ok...here's a workaround for Windows based computers. Not an ideal solution but it works. For those of you on a corporate network, I highly suggest you get this approved before you implement it.
You will need to download and install Cntlm Authentication Proxy. The link is...
http://sourceforge.net/projects/cntlm/files/
Once installed...find the cntlm.ini file located in the c:\Program Files or c:\Program Files(x86) folder and open it with notepad. Modify the following lines to match your network/proxy configuration...
Username
Domain
Password
Proxy
Once you save the cntlm.ini file go to Services and start the Cntlm Authentication Proxy service...or you could simply restart the computer.
The last step is to configure your browser to use the following address as a proxy server...
127.0.0.1 port 3128 (3128 is the default listening port used by cntlm and can be changed in the cntlm.ini file)
As I said, this is not an ideal solution as your network username and password are stored in the cntlm.ini file as clear text and if you ever change your network password you will need to change the cntlm.ini file as well. This is also why I suggest that those of you on corporate networks get approval for this before you install since this is a potential security risk. But this does resolve the proxy authentication pop up issue with iTunes and for anyone attempting to use Dropbox and having similar proxy issues this solution works for Dropbox as well.

1200 AP and Proxy authentication?

Similar Messages

Maybe you are looking for