802.1x error 23 only on Mac clients

Question

I have been using server 2008 R2 for NPS using 802.1x for about a year or so with my windows clients and it has been working perfectly.  Recently however my mac clients cannot authenticate successfully.  They get the error posted below.  I
cant find the eap log file or at least I dont know what the name of it is.  All my Windows clients still work fine, just the couple mac clients cant authenticate even though they have been working fine up until very recently.
Network Policy Server denied access to a user.
Contact the Network Policy Server administrator for more information.
User:
Security ID:
DOMAIN\username
Account Name:
username
Account Domain:
DOMAIN
Fully Qualified Account Name:
DOMAIN\username
Client Machine:
Security ID:
NULL SID
Account Name:
Fully Qualified Account Name:
OS-Version:
Called Station Identifier:
000B866D50A0
Calling Station Identifier:
F0B47923378A
NAS:
NAS IPv4 Address:
172.20.XX.XX
NAS IPv6 Address:
NAS Identifier:
172.20.XX.XX
NAS Port-Type:
Wireless - IEEE 802.11
NAS Port:
7
RADIUS Client:
Client Friendly Name:
Aruba-Master
Client IP Address:
172.20.XX.XX
Authentication Details:
Connection Request Policy Name:
Secure Wireless Connections
Network Policy Name:
Secure Wireless Connections
Authentication Provider:
Windows
Authentication Server:
RADIUS.domain.lan
Authentication Type:
PEAP
EAP Type:
Account Session Identifier:
Logging Results:
Accounting information was written to the local log file.
Reason Code:
23
Reason:
An error occurred during the Network Policy Server use of the Extensible Authentication Protocol (EAP). Check EAP log files for EAP errors.

Answer 1

I don't have a MAC client to test, so it is difficult to answer.
I can tell you that reason code 23 usually occurs when the settings on the client do not match those on the server - one side is set for EAP/TLS and the other is set for PEAP/MSCHAP, for example.
It's also possible that the MAC is doing some kind of server certificate authentication check as part of standard PEAP authentication and this is failing because the required trusted root certificates are expired, or not present.  If you can look
at the properties of the certificate store on the MAC it might help.
On a Windows client, and probably on a MAC also a requirement is that the certificate on the RADIUS server be chained to a trusted root certificate on the client. If the client doesn't have this root certificate it will give a generic error like the one
you are seeing. To fix it, you just need to request a certificate on the client.
-Greg