ACS authorization fail
dear all,
When i am accessing one of my aaa client ,
which is getting authenticated from ACS Server 4.2
it is showinng as Authorization failure , what could be the issue
configuration on device &server side is proper
Hi,
Could you provide the aaa config part from the device? Along with this, please mention the protocol which you are using (Radius/Tacacs)?
If you are using Tacacs, make sure under the group setup, you have checked "shell" and under the privilege level, entered the privilege level which the user should be assigned.
Hope this helps
Kush
Similar Messages
-
Command authorization failed ACS 5.6
I have a new ACS 5.6 appliance set up that uses Active Directory authentication.
I created a shell profile, mapped it to the authorization rule, and then added devices to the system.
The first device I added was able to use ACS to authenticate and authorize users without any issues. In the ACS logs, it shows me log in and get the shell profile/privileges (15).
The second device I added authenticates me, but then I get a "command authorization failed" message every time I try to do something. In the ACS logs, it shows me log in (using AD), and get the same shell profile (level 15). Not sure what the problem is.
Here are the AAA settings on the switch
aaa authentication login listASH group tacacs+ local
aaa authentication enable default group tacacs+ enable
aaa authorization exec listASH group tacacs+ local
aaa authorization commands 0 default group tacacs+ if-authenticated
aaa authorization commands 1 default group tacacs+ if-authenticated
aaa authorization commands 15 default group tacacs+ if-authenticated
tacacs-server host 10.1.2.212
tacacs-server timeout 3
tacacs-server directed-request
tacacs-server key <key>
line vty 0 4
access-class vty-access in
logging synchronous level all
login authentication listASH
transport input ssh
Network connectivity is fine, and obviously, the key works (because I authenticate). Nevertheless, I cannot get proper authorization.Hmm, the config looks correct, especially if it works on one device but fails on the second. Have you tried to issue some debugs and see if you are getting any errors?
debug aaa authentication
debug aaa authorization
debug tacacs authorization
Also, is there a version of code difference between the two devices? Perhaps you are hitting a bug.
Thank you for rating helpful posts! -
Enable mode authorization failed.
Have a user that cannot get to en prompt. Here is my trace output:
AAA/AUTHEN: update_user user='lduncan' ruser='(null)' port='telnet146' rem_addr=
'10.128.20.110' authen_type=1 service=ENABLE priv=152007 Oct 16 10:57:07.360 EST
-04:00
AAA/AUTHEN/START (0): port='telnet146' list='(null)' action=LOGIN service=ENABLE
TAC+: send AUTHEN/START packet ver=192 id=626074205
TAC+: Opening TCP/IP connection to 10.129.12.196
TAC+: ver=192 id=626074205 received AUTHEN status = GETPASS2007 Oct 16 10:57:08.
440 EST -04:00
AAA/AUTHEN (626074205): status = GETPASSPassword: 2007 Oct 16 10:57:11.200 EST -
04:00 *62*2007 Oct 16 10:57:11.440 EST -04:00 *69*2007 Oct 16 10:57:11.800 EST -
04:00 *67*2007 Oct 16 10:57:12.050 EST -04:00 *74*2007 Oct 16 10:57:12.300 EST -
04:00 *6f*2007 Oct 16 10:57:12.530 EST -04:00 *65*
2007 Oct 16 10:57:12.950 EST -04:00
AAA/AUTHEN/CONT (626074205): continue_login2007 Oct 16 10:57:12.950 EST -04:00
AAA/AUTHEN (626074205): status = GETPASS
TAC+: send AUTHEN/CONT packet id=626074205
TAC+: ver=192 id=626074205 received AUTHEN status = PASS2007 Oct 16 10:57:13.460
EST -04:00
AAA/AUTHEN (626074205): status = PASS2007 Oct 16 10:57:13.460 EST -04:00 return
PASS
2007 Oct 16 10:57:13.460 EST -04:00
AAA/AUTHOR : ptr2=enable
2007 Oct 16 10:57:13.470 EST -04:00
AAA/AUTHOR : Add AV service=shell
2007 Oct 16 10:57:13.470 EST -04:00
AAA/AUTHOR : Add AV cmd=enable
2007 Oct 16 10:57:13.470 EST -04:00
AAA/AUTHOR/TACACS+ cmd author (413075467): Port='telnet146' list='(null)' servic
e=CMD2007 Oct 16 10:57:13.480 EST -04:00
AAA/AUTHOR/TACACS+ cmd author: (413075467) user='lduncan'2007 Oct 16 10:57:13.4
80 EST -04:00
AAA/AUTHOR/TACACS+ cmd author: (413075467) send AV service=shell2007 Oct 16 10:5
7:13.480 EST -04:00
AAA/AUTHOR/TACACS+ cmd author: (413075467) send AV cmd=enable
AAA/AUTHOR/TACACS+ cmd author: (413075467) Method=TAC_PLUS2007 Oct 16 10:57:13.4
90 EST -04:00
AAA/AUTHOR/TAC+: (413075467): user=lduncan2007 Oct 16 10:57:13.490 EST -04:00
AAA/AUTHOR/TAC+: (413075467): send AV service=shell2007 Oct 16 10:57:13.490 EST
-04:00
AAA/AUTHOR/TAC+: (413075467): send AV cmd=enable
TAC+: Opening TCP/IP connection to 10.129.12.196
TAC+: (413075467): received author response status = FAIL2007 Oct 16 10:57:14.50
0 EST -04:00
AAA/AUTHOR (413075467): Post authorization status = FAIL2007 Oct 16 10:57:14.500
EST -04:00
AAA/AUTHOR : do_author result=12007 Oct 16 10:57:14.500 EST -04:00 %AAA: author:
tacacs_plus_author ret=1.
Enable mode authorization faile
I have checked his user info and group info in tacacs.It seems that you have command author configured that is why user in not able to issue it.
What kind of user is it ? Admin or normal user.
To make him login you need to make changes in the command author set.
Make one command autho set in acs --->shared profile componenets.
add-->give any name "Full access "---> Put radio button to permit and submit.
Now go to that group-->Under Shell Command Authorization Set---> Choose--->Assign a Shell Command Authorization Set for any network device and select FULL ACCESS from list and submit apply.
Now it should let you in.
Caution : This is let that uses to issue all commands
Also provide me more info if you want user to deny some commands. We need to set up command autho set accordingly.
Regards,
~JG
Please rate helpful posts -
I have turned on the aaa command authorization without applying adequate privileges to the user. I can now login through that user but the ASA 5510 displays an error :
============================
EUKFW2# show running-config
^
ERROR: % Invalid input detected at '^' marker.
ERROR: Command authorization failed
============================
I am unable to make any configuration changes on the firewall. Is there any default user through which I can login and disable the aaa authorization ? if not, how can I resolve this situation ?No there is no default user. To make him login you need to make changes in the command author set.
Make one command autho set in acs --->shared profile components.
add-->give any name "Full access "---> Put radio button to permit and submit.
Now go to that group-->Under Shell Command Authorization Set---> Choose--->Assign a Shell Command Authorization Set for any network device and select FULL ACCESS from list and submit apply.
Now it should let you in.
Caution : This is let that uses to issue all commands
Find attached the way to set up command authorization.
Trick here is to give all user prov lvl 15 and then apply command autho set.
Having Priv lvl 15 does not mean that user will be able to issue all commands. User will only be able to issue commands that you have listed.
Regards,
~JG
Please rate if helps -
AAA -- Int range configuration gives "Command authorization failed" msg.
Versions involved:
AAA
ACS 4.1.4.13.12
Devices:
C2960-LANBASE-M, Version 12.2(25)SEE3, RELEASE SOFTWARE (fc2)
C3550-I9Q3L2-M, Version 12.1(14)EA1a, RELEASE SOFTWARE (fc1)
If we try to configure a single interface or just a very small range, it works fine, but if we try to configure a larger range of interfaces, we get a Command authorization failed message, as can be seen below:
HOST1184(config)#int range fastEthernet 0/1 - 3
HOST1184(config-if-range)# switchport access vlan 24
HOST1184(config-if-range)# switchport mode access
HOST1184(config-if-range)# switchport voice vlan 301
HOST1184(config-if-range)# dot1x pae authenticator
HOST1184(config-if-range)# dot1x port-control auto
HOST1184(config-if-range)# dot1x timeout reauth-period 7200
HOST1184(config-if-range)# dot1x timeout supp-timeout 120
HOST1184(config-if-range)# dot1x max-req 1
HOST1184(config-if-range)# dot1x max-reauth-req 1
HOST1184(config-if-range)# dot1x reauthentication
HOST1184(config-if-range)# dot1x guest-vlan 280
HOST1184(config-if-range)# spanning-tree portfast
HOST1184(config-if-range)#!
OST1184(config-if-range)#end
HOST1184#conf t
Enter configuration commands, one per line. End with CNTL/Z.
HOST1184(config)#int range fastEthernet 0/4 - 14
HOST1184(config-if-range)# switchport access vlan 24
Command authorization failed.
Command authorization failed.
Command authorization failed.
HOST1184(config-if-range)# switchport mode access
HOST1184(config-if-range)# switchport voice vlan 301
HOST1184(config-if-range)# dot1x pae authenticator
HOST1184(config-if-range)# dot1x port-control auto
Command authorization failed.
HOST1184(config-if-range)# dot1x timeout reauth-period 7200
Command authorization failed.
HOST1184(config-if-range)# dot1x timeout supp-timeout 120
Command authorization failed.
HOST1184(config-if-range)# dot1x max-req 1
Command authorization failed.
HOST1184(config-if-range)# dot1x max-reauth-req 1
Command authorization failed.
HOST1184(config-if-range)# dot1x reauthentication
Command authorization failed.
HOST1184(config-if-range)# dot1x guest-vlan 280
Command authorization failed.
HOST1184(config-if-range)# spanning-tree portfast
Command authorization failed.
HOST1184(config-if-range)#!
The pieces of config are as follows:
aaa new-model
aaa group server radius dot1x
server 10.61.156.136 auth-port 1812 acct-port 1813
aaa authentication login default group tacacs+ enable
aaa authentication enable default group tacacs+ enable
aaa authentication dot1x default group dot1x
aaa authorization config-commands
aaa authorization exec default group tacacs+ if-authenticated none
aaa authorization commands 0 default group tacacs+ if-authenticated
aaa authorization commands 1 default group tacacs+ if-authenticated
aaa authorization commands 15 default group tacacs+ if-authenticated
aaa accounting exec default start-stop group tacacs+
aaa accounting commands 0 default start-stop group tacacs+
aaa accounting commands 1 default start-stop group tacacs+
aaa accounting commands 15 default start-stop group tacacs+
aaa accounting system default start-stop group tacacs+
enable secret 5 <removed>
logging 10.142.4.45
snmp-server community <removed> RO
snmp-server community <removed> RW
snmp-server location "SD"
snmp-server contact contact - [email protected]
tacacs-server host A.B.C.D timeout 5 key <removed>
tacacs-server host A.B.C.D timeout 5 key <removed>
tacacs-server host A.B.C.D timeout 5 key <removed>
no tacacs-server directed-request
radius-server host 10.61.156.136 auth-port 1812 acct-port 1813 key 7 096E5C3D4851
radius-server retransmit 3
Anyone out there has a solution for such a problem?
Regards,
ALHi JG, thanks for your response.
I don't have the appliance close to me, so I cannot check on this setting.
As soon as I have a chance, I will return with this info.
Anyway, why does it work for other devices and also, why we don't have any problem when configuring a small range of interfaces?
Once again, thanks for your reply.
Regards,
AL -
Analysis Authorization failed for Multiprovider
Hi all,
We are facing an issue pertaining to the Analysis Authorization for a multiprovider. When we attempt to access a query base on a multiprovider, the program complains that it has insufficient authorization. So we did debugging in the customer exit and we realise it fails to populate the rest of the authorization variables in I_step = 0. Base on our initial investigation this only happens on queries on multiprovider, so is there anything I need to set or do to curb this error?
Many thanks!Best solution is to trace the authorization for your issue in ST01.
Switch on the trace in ST01 and start your work. if you face authoirzation check failed. look into the trace there you will find the logs and authorization failed for your userid.
And one more thing, have you got anything in SU53 as authorization check failed?
Hope this would help you. -
Authorization failed when trying to connect Hyperion to BW 7.0
Hello gurus,
Using Hyperion interactive Reporting Studio, I try to access BW cubes.
I select OLE DB as connection type and SAP BW OLE DB provider, I am prompted for a BW system to connect to.
I then get the following error message:
OLE Error: 80040e4d
Error Source: MDrmSAP.2
Error Desciption: Authorization failed.
Using the same BW provider and the same BW user, I am able to connect form Excel.
So I wonder what the problem is.
Help really appreciated.
Alex-Hi Ingo,
I do not get any error while using the Universe Designer, I get this error when trying to connect a SAP BW related universe in Crystal Reports. There is no problem at all with WebIntelligence by the way. It is possible to connect a SAP BW related universe in WebIntelligence.
I use BO XI 3.0 with Crystal Reports 2008 and the SAP Integrations Kit client components are installed on the client machine.
Nevertheless the BO Enterprise system is not configured with SAP Authentification, but with an own authentification.
Best Regards,
Thomas -
ISE Alarm (WARNING): Dynamic Authorization Failed for Device
Hi all,
I am posting this discussion as previous posts that I have found in this forum have never been resolved or the resolution is not applicable to me.
I am using ISE 1.1.1.268 and WLC 7.2.111.3 and NAC agent version 4.9.1.6 on Windows 7 Client machines.
About once a day i get the error "ISE Alarm (WARNING): Dynamic Authorization Failed for Device".
The device it is reffering to is my NAD, a WLC 5508 running 7.2.111.3
I have looked at the logs and I cannot see anything in the logs which correcponds to this message so that I can troubleshoot further. Maybe I can if I am enabling the correct logging level on the correct ISE component.
Can someone suggest the components and the logging level that I should set to get some more detail about this error?
At the moment, I have only set debug logging on Active Directory. I have TRACE logging set on Posture, Runtime AAA & prrt-JNI.
I do not want to enable too much debug logs, so I was wondering whether anyone can help with a specific element that I should be debugging.
I thought debugging the posture element would be enough but when I look at the logs there is nothing there that relates to this message.
Can anyone help?
thanks
MarioFirstly, I wouldn't run a production deployment of ISE on 1.1.1.... 1.1.3 Patch 1 or 1.1.4 is the way to go.
Secondly, this error happen a lot, especially with Wireless, and it's not worth worrying about. I've had a couple of TAC cases opened for this and some similar errors, generally they're caused by a Client going to sleep, leaving the coverage area or otherwise leaving the WLC while ISE is trying to do something with it.
Only worry if you actually have a Client-impacting problem, which by the sounds of it, you don't. -
ISE: Dynamic Authorization Failed
Hi,
I am gettning warning messages in ISE saying
Cause:
Dynamic Authorization Failed for Device: 0002SWC003 (switch)
Details:
Dynamic Authorization Failed
It is not only on that switch but on all switches I have configured. I am using 3560 IPBase 12.2(55)SE6. I have configured them according to Trustsec 2.1.
My end devices are none-802.1x.
I can't figure out what is causing this error.
The thing is that I have not experienced any problem. In Live Authentications there are some 'Unknown' and 'Profiled' devices hitting the DenyAccess rule, but other then that everying is beeing Authorized fine.
Anyone got an idea what could be causing this error?
Regards,
PhilipThis is what I have found out.. Using ISE Version 1.1.1.268. If you go the logs page
Jan 10,13 7:39:12.147 AM
Dynamic Authorization failed
and then go to the details...
Failure Reason > Authentication Failure Code Lookup
Failure Reason :
11213 No response received from Network Access Device
Generated on:January 10, 2013 8:08:17 AM PST
Description
No response received from Network Access Device.
Resolution Steps
Check the connectivity between ISE and Network Access Device. Ensure that ISE is defined as Dynamic Authorization Client on Network Access Device and that CoA is supported on device.
...next check into Resolution Steps... -
5417 Dynamic Authorization failed
Hi guys,
Does anyone meet this Radius Error in Cisco ISE 1.2 and the switch 2960 12.2(55)SE7 ?
When i reauthentication the guest profile to the other profile using Radius CoA on the Self-Service Guest Workflow.
The error is :
Event
5417 Dynamic Authorization failed
Failure Reason
11103 RADIUS-Client encountered error during processing flow
Resolution
Do the following: 1) Verify shared secret matches on the ISE Server and corresponding AAA Client, External AAA Server or External RADIUS Token Server. 2) Check the AAA Client or External Server for hardware problems. 3) Check the network devices that connect the AAA peer to ISE for hardware problems. 4) Check whether the network device or AAA Client has any known RADIUS compatibility issues.
Root cause
RADIUS-Client encountered an error during processing flow
I checked all the resolution steps but the error sitll exsit.
I would greatly appreciate any help you can give me in working this problemAn internal error has been detected during the processing of an incoming RADIUS packet. Make sure that the client device is compatible with AD Agent, has been configured properly, and is functioning properly. Make sure that the same RADIUS shared secret has been properly configured, both in the client device and in AD Agent.
http://www.cisco.com/c/en/us/td/docs/security/ibf/setup_guide/ad_agent_setup_guide/ibf10_log_msgs.html -
hi
I keep getting error meesages on the ISE in regards to RADIUS
the error is
Dynamic Authorization failed : 1213 No response received from Network Access Device
i am using ISE version 1.1.1 and the NAD is a WLC running version 7.0.98.0
i use ISE to authenticate users via PEAP. I deleted the NAD and re-added it twice but i still keep getting this issue. this set up was working fine for the last few weeks.
i dont think location and device type would cause an issue to authentication under the NAD list
anyone have any ideas?the option i.e drop down box wasnt there. lookin at the compatibility chart of ISE 1.1.1 and WLC, minimum version for WLC is 7.2.103.0
Do you need to have RADIUS NAC enabled if the ISE is only used to authenticate corporate wireless users against AD. there is no CoA,
the other function is to use RADIUS as network management logon. to WLC using the AD. depending on the AD group , one could get priv 15 or priv 5 access. i am also using device attribute by location so that remote offices network enigineer cannot log onto the WLC. i.e i created a NAD , put it in a location and use that location AND the AD group to qualify for priv 15 access.
Coudl this policy interrupt the wireless RADIUS policy? Wireless policy is at the top of the list under authorization tab. -
Dynamic Authorization Failed: DiconnectNAK
I have WLC 7.6 and ISE 1.2 Patch 6.
My use case is WLAN Guest Access with CWA. I have ISE Appliance 3395 (2 Admin/Mon, 2 PSN). Everything work fine so far.
But from time to time I get these strange message (it does not matter if I do a manual Session termination in the Operations Tab) Everything is configured in the right way, since normal CWA works (CoA is working fine, but not always...).
Here the corresponding Log-Entry:
0000001241 2 0 2014-02-28 11:11:37.241 +01:00 0000106595 5417 NOTICE Dynamic-Authorization: Dynamic Authorization failed, ConfigVersionId=53, Device IP Address=a.b.c.d, Device Port=42121, DestinationIPAddress=a.b.c.d, DestinationPort=1700, RadiusPacketType=DisconnectRequest, Protocol=Radius, RequestLatency=3, NetworkDeviceName=xx-WLC01, NAS-IP-Address=172.16.226.26, Calling-Station-ID=1C:AB:A7:96:7B:99, Acct-Session-Id=53105c2a/1c:ab:a7:96:7b:99/336136, Acct-Terminate-Cause=Admin Reset, Event-Timestamp=1393582297, cisco-av-pair=audit-session-id=ac10e21a00052f6953105f07, AcsSessionID=ise-04/182359788/9392, Step=11044, Step=11017, Step=11100, Step=11101, Step=11048, NetworkDeviceGroups=Location#All Locations#xx_VPN, NetworkDeviceGroups=Device Type#All Device Types#Wireless Devices#WLC Foreign, CPMSessionID=ac10e21a00052f6953105f07, EndPointMACAddress=1C-AB-A7-96-7B-99, Location=Location#All Locations#xx_VPN,
Has anybody ever had the same expirence, or is this a know issue?
Thanks for feedback!Please go through the link below for best practice.
http://www.redelijkheid.com/blog/2013/4/2/cisco-ise-change-of-authorization-coa-not-working -
Dynamic Authorization Failed - Posture with Guest Portal - ISE - WLC
Hello everybody,
I'm implementing a NAC solution based on Cisco ISE. Unfortunately, I'm facing a problem related to the CoA (Change of Authorization).
The guest can authenticate successfully via portal and then he is redirected to the page of client provisioning.
When he is compliant with the policy he gets access without any problem and this means that CoA works perfectly. The issue occurs when he has to remediate (download the file from ISE and install it). In this case, we need a change of authorization profile.
The authentication logs show that the posture status changed from non-compliant to compliant but the users doesn't obtain access .
Here are details :
Authentication Details
Source Timestamp
2015-04-30 18:43:13.179
Received Timestamp
2015-04-30 18:43:13.18
Policy Server
ISE-CISCO
Event
5417 Dynamic Authorization failed
Failure Reason
11213 No response received from Network Access Device after sending a Dynamic Authorization request
Resolution
Check the connectivity between ISE and Network Access Device. Ensure that ISE is defined as Dynamic Authorization Client on Network Access Device and that CoA is supported on device.
Root cause
No response received from Network Access Device after sending a Dynamic Authorization request
Username
User Type
Endpoint Id
E0:9D:31:07:**:**
Endpoint Profile
IP Address
Identity Store
Identity Group
Audit Session Id
ca0019ac00000003ae674255
Authentication Method
Authentication Protocol
Service Type
Network Device
WLC-1
Device Type
Location
NAS IP Address
172.25.0.202
NAS Port Id
NAS Port Type
Authorization Profile
Posture Status
Compliant
Security Group
Response Time
15002
Other Attributes
ConfigVersionId
4
RadiusPacketType
CoARequest
Event-Timestamp
1430415778
AcsSessionID
50149c2f-08fb-4f9d-b1b5-f655e71d039f
StepLatency
3=15001
Device IP Address
172.25.0.202
CiscoAVPair
subscriber:command=reauthenticate
audit-session-id
ca0019ac00000003ae674255
Session Events
2015-04-30 18:43:13.18
Dynamic Authorization failed
2015-04-30 18:41:44.159
Dynamic Authorization failed
2015-04-30 18:35:42.64
Guest Authentication Passed
2015-04-30 18:34:39.214
RADIUS Accounting start requestYou can use LWA for this . he WLC redirects the HTTP traffic to an internal or external server where the user is prompted to authenticate. The WLC then fetches the credentials (sent back via an HTTP GET request in the case of external server) and makes a RADIUS authentication. In the case of a guest user, an external server (such as Identity Service Engine (ISE) or NAC Guest Server (NGS)) is required as the portal provides features such as device registering and self-provisioning.
Refer to the following link for configuration example
http://www.cisco.com/en/US/products/ps11640/products_configuration_example09186a0080bead09.shtml -
10.6.4 Server L2TP VPN using external RADIUS - Authorization Failed
I'm using 10.6.4 with VPN L2TP configured successfully using local user database for authentication. Now i want to configure the VPN to use Steel Belted Radius server for authentication (that hooked up to another LDAP server) for authentication.
I've configured the VPN service to use the radius server, authentication to radius is occurring but i'm getting errors that the user is not authorized to use the VPN service.
Is there a way to configure 10.6's VPN service to authorize any user that successfully authenticates against Radius?
NOTE: I've played around with Server Admin's access for VPN, with it set to all users, everyone ect, this did not make any difference to the error i'm getting from the vpn service.
Here's the log out put when the connection fails.
2010-08-27 12:52:34 PDT Loading plugin /System/Library/Extensions/L2TP.ppp
2010-08-27 12:52:34 PDT Listening for connections...
2010-08-27 12:52:39 PDT Incoming call... Address given to client = 192.168.105.1
Fri Aug 27 12:52:39 2010 : Directory Services Authorization plugin initialized
Fri Aug 27 12:52:39 2010 : L2TP incoming call in progress from '[ip address redacted]'…
Fri Aug 27 12:52:39 2010 : L2TP received SCCRQ
Fri Aug 27 12:52:39 2010 : L2TP sent SCCRP
Fri Aug 27 12:52:39 2010 : L2TP received SCCCN
Fri Aug 27 12:52:39 2010 : L2TP received ICRQ
Fri Aug 27 12:52:39 2010 : L2TP sent ICRP
Fri Aug 27 12:52:39 2010 : L2TP received ICCN
Fri Aug 27 12:52:39 2010 : L2TP connection established.
Fri Aug 27 12:52:39 2010 : using link 0
Fri Aug 27 12:52:39 2010 : Using interface ppp0
Fri Aug 27 12:52:39 2010 : Connect: ppp0 <--> socket[34:18]
Fri Aug 27 12:52:39 2010 : sent [LCP ConfReq id=0x1 <asyncmap 0x0> <auth chap MS-v2> <magic 0x55fc9b88> <pcomp> <accomp>]
Fri Aug 27 12:52:39 2010 : rcvd [LCP ConfReq id=0x1 <asyncmap 0x0> <magic 0x7e9db3cb> <pcomp> <accomp>]
Fri Aug 27 12:52:39 2010 : lcp_reqci: returning CONFACK.
Fri Aug 27 12:52:39 2010 : sent [LCP ConfAck id=0x1 <asyncmap 0x0> <magic 0x7e9db3cb> <pcomp> <accomp>]
Fri Aug 27 12:52:39 2010 : rcvd [LCP ConfAck id=0x1 <asyncmap 0x0> <auth chap MS-v2> <magic 0x55fc9b88> <pcomp> <accomp>]
Fri Aug 27 12:52:39 2010 : sent [LCP EchoReq id=0x0 magic=0x55fc9b88]
Fri Aug 27 12:52:39 2010 : sent [CHAP Challenge id=0xc8 <086a03234947113037497f4326585a1f>, name = "OSX SERVER"]
Fri Aug 27 12:52:39 2010 : rcvd [LCP EchoReq id=0x0 magic=0x7e9db3cb]
Fri Aug 27 12:52:39 2010 : sent [LCP EchoRep id=0x0 magic=0x55fc9b88]
Fri Aug 27 12:52:39 2010 : rcvd [LCP EchoRep id=0x0 magic=0x7e9db3cb]
Fri Aug 27 12:52:39 2010 : rcvd [CHAP Response id=0xc8 <5ad3c0cb063694e473f51c9252e007f400000000000000003701b4fa8e7b844e072cddeceefa73 173d7415c85cae976700>, name = "USERNAME"]
Fri Aug 27 12:52:40 2010 : sent [CHAP Success id=0xc8 "S=934D6E79F45791A61C378789A4D719BC6F249574"]
*Fri Aug 27 12:52:40 2010 : CHAP peer authentication succeeded for USERNAME*
*Fri Aug 27 12:52:40 2010 : DSAccessControl plugin: User 'USERNAME' not authorized for access*
*Fri Aug 27 12:52:40 2010 : sent [LCP TermReq id=0x2 "Authorization failed"]*
Fri Aug 27 12:52:40 2010 : Connection terminated.
Fri Aug 27 12:52:40 2010 : L2TP disconnecting...
Fri Aug 27 12:52:40 2010 : L2TP sent CDN
Fri Aug 27 12:52:40 2010 : L2TP sent StopCCN
Fri Aug 27 12:52:40 2010 : L2TP disconnected
2010-08-27 12:52:40 PDT --> Client with address = 192.168.105.1 has hungup
Message was edited by: sarah maysI'm using 10.6.4 with VPN L2TP configured successfully using local user database for authentication. Now i want to configure the VPN to use Steel Belted Radius server for authentication (that hooked up to another LDAP server) for authentication.
I've configured the VPN service to use the radius server, authentication to radius is occurring but i'm getting errors that the user is not authorized to use the VPN service.
Is there a way to configure 10.6's VPN service to authorize any user that successfully authenticates against Radius?
NOTE: I've played around with Server Admin's access for VPN, with it set to all users, everyone ect, this did not make any difference to the error i'm getting from the vpn service.
Here's the log out put when the connection fails.
2010-08-27 12:52:34 PDT Loading plugin /System/Library/Extensions/L2TP.ppp
2010-08-27 12:52:34 PDT Listening for connections...
2010-08-27 12:52:39 PDT Incoming call... Address given to client = 192.168.105.1
Fri Aug 27 12:52:39 2010 : Directory Services Authorization plugin initialized
Fri Aug 27 12:52:39 2010 : L2TP incoming call in progress from '[ip address redacted]'…
Fri Aug 27 12:52:39 2010 : L2TP received SCCRQ
Fri Aug 27 12:52:39 2010 : L2TP sent SCCRP
Fri Aug 27 12:52:39 2010 : L2TP received SCCCN
Fri Aug 27 12:52:39 2010 : L2TP received ICRQ
Fri Aug 27 12:52:39 2010 : L2TP sent ICRP
Fri Aug 27 12:52:39 2010 : L2TP received ICCN
Fri Aug 27 12:52:39 2010 : L2TP connection established.
Fri Aug 27 12:52:39 2010 : using link 0
Fri Aug 27 12:52:39 2010 : Using interface ppp0
Fri Aug 27 12:52:39 2010 : Connect: ppp0 <--> socket[34:18]
Fri Aug 27 12:52:39 2010 : sent [LCP ConfReq id=0x1 <asyncmap 0x0> <auth chap MS-v2> <magic 0x55fc9b88> <pcomp> <accomp>]
Fri Aug 27 12:52:39 2010 : rcvd [LCP ConfReq id=0x1 <asyncmap 0x0> <magic 0x7e9db3cb> <pcomp> <accomp>]
Fri Aug 27 12:52:39 2010 : lcp_reqci: returning CONFACK.
Fri Aug 27 12:52:39 2010 : sent [LCP ConfAck id=0x1 <asyncmap 0x0> <magic 0x7e9db3cb> <pcomp> <accomp>]
Fri Aug 27 12:52:39 2010 : rcvd [LCP ConfAck id=0x1 <asyncmap 0x0> <auth chap MS-v2> <magic 0x55fc9b88> <pcomp> <accomp>]
Fri Aug 27 12:52:39 2010 : sent [LCP EchoReq id=0x0 magic=0x55fc9b88]
Fri Aug 27 12:52:39 2010 : sent [CHAP Challenge id=0xc8 <086a03234947113037497f4326585a1f>, name = "OSX SERVER"]
Fri Aug 27 12:52:39 2010 : rcvd [LCP EchoReq id=0x0 magic=0x7e9db3cb]
Fri Aug 27 12:52:39 2010 : sent [LCP EchoRep id=0x0 magic=0x55fc9b88]
Fri Aug 27 12:52:39 2010 : rcvd [LCP EchoRep id=0x0 magic=0x7e9db3cb]
Fri Aug 27 12:52:39 2010 : rcvd [CHAP Response id=0xc8 <5ad3c0cb063694e473f51c9252e007f400000000000000003701b4fa8e7b844e072cddeceefa73 173d7415c85cae976700>, name = "USERNAME"]
Fri Aug 27 12:52:40 2010 : sent [CHAP Success id=0xc8 "S=934D6E79F45791A61C378789A4D719BC6F249574"]
*Fri Aug 27 12:52:40 2010 : CHAP peer authentication succeeded for USERNAME*
*Fri Aug 27 12:52:40 2010 : DSAccessControl plugin: User 'USERNAME' not authorized for access*
*Fri Aug 27 12:52:40 2010 : sent [LCP TermReq id=0x2 "Authorization failed"]*
Fri Aug 27 12:52:40 2010 : Connection terminated.
Fri Aug 27 12:52:40 2010 : L2TP disconnecting...
Fri Aug 27 12:52:40 2010 : L2TP sent CDN
Fri Aug 27 12:52:40 2010 : L2TP sent StopCCN
Fri Aug 27 12:52:40 2010 : L2TP disconnected
2010-08-27 12:52:40 PDT --> Client with address = 192.168.105.1 has hungup
Message was edited by: sarah mays -
Webservice call from PCo; FaultException: Authorization fail
Hi,
I am making a ME Webservice call from PCo.
I have configured Destination System, added a service in Configuration tab.
Using 'Test request message', i tested the call with all required inputs, the object is created in ME system.
When the same service is triggered from PLC > PCo, the call fails and i see the following message in Log tab.
UserName/password is correct..
All the required systems are running.
Log:
ME Dispatcher Could not dispatch Message [id = 75c405c5-24d4-4f70-b19a-87f6b6ae0413].
FaultException: Authorization failed. Please check security log for details.
Server stack trace:
at System.ServiceModel.Channels.ServiceChannel.HandleReply(ProxyOperationRuntime operation, ProxyRpc& rpc)
at System.ServiceModel.Channels.ServiceChannel.Call(String action, Boolean oneway, ProxyOperationRuntime operation, Object[] ins, Object[] outs, TimeSpan timeout)
at System.ServiceModel.Channels.ServiceChannel.Call(String action, Boolean oneway, ProxyOperationRuntime operation, Object[] ins, Object[] outs)
at System.ServiceModel.Channels.ServiceChannelProxy.InvokeService(IMethodCallMessage methodCall, ProxyOperationRuntime operation)
at System.ServiceModel.Channels.ServiceChannelProxy.Invoke(IMessage message)
Exception rethrown at [0]:
at SAP.Manufacturing.Connectivity.WSDestination.WSDestination.Send(Guid notificationID, Dictionary`2 requestValues)
at SAP.Manufacturing.Connectivity.WSDestination.WSDestination.Send(NotificationMessage message)
at SAP.Manufacturing.Connectivity.Dispatcher.ProcessMessage(NotificationMessage message, DestinationBase destination)
at SAP.Manufacturing.Connectivity.Dispatcher.DispatchMessageExecute(Message message, Boolean unlockMessage, Boolean& stopDispatcher)
Am I missing anything?
Version:
ME: 6.1.4.9
PCo: 2.3
Thanks,Hello Shridhar, I guess you can use use different user for authentication and user data inside XML request.
In MII, I have used MESYS for authentication and other user name inside the request XML. But you need to make sure user name inside XML has ME_Integrator role.
<me:UserId>USERID</me:UserId>
Hope this helps.
Thanks
Hari
Maybe you are looking for
-
Some graphs don't display in OEM Grid Control 10gR5 (10.2.0.5)
A number of the performance graphs (e.g. Top Activity) don't display i.e. there is nothing but if if you right-click in the empty area you get a small pull down with Print, Settings, About Adobde Flash 10. This has all happend after upgrading to 10.2
-
How to go to a particular node in a hierarchical tree?
I want to do this simple thing with a Forms hierarchical tree. Since tree has lots of levels and branches I want to give a search box. User types the label and press a button. The form then has to query the tree node and expand ONLY the path where th
-
Is it possible to add things to an iPad or iPhone without the use of iTunes?
My intention is travelling abroad for a year or two, and I don't want to take a laptop because it is too big and heavy. I have my iPhone, but I'm trying to decide if an iPad would be useful too. The problem is - because I wont have a computer with
-
Compilation problem in PXIe-7695R FlexRIO
Hello, I am new to LabVIEW FPGA, before this, i used to do FPGA's in VHDL using ISE suite. In that process, I just need to change the bit files from iMPACT and my FPGA runs with the new bit file. but I am trying to do the same thing here and facing p
-
To display few lines of texts in a paragraph in bold in chinese
Hi, I have a requirement to display smartform output in English and Chinese.In a paragraph few lines have to be displayed in bold in chinese. I have created a standard text in chinese languge to diplay this text.In the standard text,few lines have to