Authentication methods for BYOD senario?

I am in charge of setting up a 2500 wireless controller and a slew of 1142n APs as well coming up with a method to authenticate devices. This is a bring your own device senario so I do not have admin access to the devices. I would think that using MAC address filtering and a WEP key for authentication is the simplest and most cross platform method. Is there a way that I can capture the MAC addresses from the devices from lets say one of my APs and then add the MACs to the filter database? The person that will be adding the devices and the device owners themselves (high school students) might have a hard time finding the MAC of the devices, not to mention the possibility of entering them incorrectly. I was thinking that I can have an AP near the person that the users go to for setting up access that is setup to only use a WEP key to authenticate and then capture the MAC address of the authenticated devices to add to the MAC filter database used for the rest of the APs on the campus.
Thanks in advance!

The limit is indeed on the WLC. You can only have 2048 records. These records can be account logons, mac addresses etc. They all pull from the same pull.
If you are only managing a few macs then it may not be so bad. If you are doing 50+ it will be a pain. Also it adds little value. Anyone can spoof a mac address get around mac filtering.
Does that help ?
"Satisfaction does not come from knowing the solution, it comes from knowing why." - Rosalind Franklin
‎"I'm in a serious relationship with my Wi-Fi. You could say we have a connection."

Similar Messages

Authentication method for JCo connection in XSS installation

Hi All,
I have a query which perplexes me. I am implementing XSS (ESS/MSS) on SAP Portal EP6 SR1 with an ECC5 backend for prototype purposes.
When I follow SAP's help steps to setup JCo connections, it states that for the metadata connection you should use a security authentication method of 'User/Password', but for the application data connection you should use a security authentication method of 'Ticket'.
Does anyone know why the difference in methods here? Is it possible to use 'User/Password' for both? Any thoughts would be appreciated.

Hi john,
User -ID /Pwd method can be used to access the backend for both types of Data as per your scenario.
User -ID /Pwd method and logon tickets both can be used to access data in backend.
The difference lies in the scenario with which you are accessing the back-end.
If all your portal users are same as backend users then you can select Logon ticket methods.
If they are going to be different then you need User-ID /Pwd method .
Check the following link to get a clear picture:
<a href="http://help.sap.com/saphelp_ep50sp2/helpdata/en/4d/dd9b9ce80311d5995500508b6b8b11/frameset.htm">Scenario to use type of SSO</a>
Hope it helps.
Regards,
Vivekanandan

Best authentication method for controlling access to wlan

What is the best method for controlling access to a wlan with a 5508 wlan controller
The requirments are
-Needs to support all types of clients (Mac, PC, smartphones, tablets)
-Clients need to be able to connect easily and without errors or installing certs or wireless profiles etc..
-Secure
This doesn't seem like alot to ask but I keep running into problems.
What are people using?
Thanks

I can't find an errors in any area of the event viewer.
Here is these files cat'd together.
GeoTrustGlobalCA
GeoTrustDVSSLCA
corp-vs-ca2.########-export
-----BEGIN CERTIFICATE-----
MIIDVDCCAjygAwIBAgIDAjRWMA0GCSqGSIb3DQEBBQUAMEIxCzAJBgNVBAYTAlVT
MRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMRswGQYDVQQDExJHZW9UcnVzdCBHbG9i
YWwgQ0EwHhcNMDIwNTIxMDQwMDAwWhcNMjIwNTIxMDQwMDAwWjBCMQswCQYDVQQG
EwJVUzEWMBQGA1UEChMNR2VvVHJ1c3QgSW5jLjEbMBkGA1UEAxMSR2VvVHJ1c3Qg
R2xvYmFsIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2swYYzD9
9BcjGlZ+W988bDjkcbd4kdS8odhM+KhDtgPpTSEHCIjaWC9mOSm9BXiLnTjoBbdq
fnGk5sRgprDvgOSJKA+eJdbtg/OtppHHmMlCGDUUna2YRpIuT8rxh0PBFpVXLVDv
iS2Aelet8u5fa9IAjbkU+BQVNdnARqN7csiRv8lVK83Qlz6cJmTM386DGXHKTubU
1XupGc1V3sjs0l44U+VcT4wt/lAjNvxm5suOpDkZALeVAjmRCw7+OC7RHQWa9k0+
bw8HHa8sHo9gOeL6NlMTOdReJivbPagUvTLrGAMoUgRx5aszPeE4uwc2hGKceeoW
MPRfwCvocWvk+QIDAQABo1MwUTAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBTA
ephojYn7qwVkDBF9qn1luMrMTjAfBgNVHSMEGDAWgBTAephojYn7qwVkDBF9qn1l
uMrMTjANBgkqhkiG9w0BAQUFAAOCAQEANeMpauUvXVSOKVCUn5kaFOSPeCpilKIn
Z57QzxpeR+nBsqTP3UEaBU6bS+5Kb1VSsyShNwrrZHYqLizz/Tt1kL/6cdjHPTfS
tQWVYrmm3ok9Nns4d0iXrKYgjy6myQzCsplFAMfOEVEiIuCl6rYVSAlk6l5PdPcF
PseKUgzbFbS9bZvlxrFUaKnjaZC2mqUPuLk/IH2uSrW4nOQdtqvmlKXBx4Ot2/Un
hw4EbNX/3aBd7YdStysVAq45pmp06drE57xNNB6pXE0zX5IJL4hmXXeXxx12E6nV
5fEWCRE11azbJHFwLJhWC9kXtNHjUStedejV0NxPNO3CBWaAocvmMw==
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIID+jCCAuKgAwIBAgIDAjbSMA0GCSqGSIb3DQEBBQUAMEIxCzAJBgNVBAYTAlVT
MRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMRswGQYDVQQDExJHZW9UcnVzdCBHbG9i
YWwgQ0EwHhcNMTAwMjI2MjEzMjMxWhcNMjAwMjI1MjEzMjMxWjBhMQswCQYDVQQG
EwJVUzEWMBQGA1UEChMNR2VvVHJ1c3QgSW5jLjEdMBsGA1UECxMURG9tYWluIFZh
bGlkYXRlZCBTU0wxGzAZBgNVBAMTEkdlb1RydXN0IERWIFNTTCBDQTCCASIwDQYJ
KoZIhvcNAQEBBQADggEPADCCAQoCggEBAKa7jnrNpJxiV9RRMEJ7ixqy0ogGrTs8
KRMMMbxp+Z9alNoGuqwkBJ7O1KrESGAA+DSuoZOv3gR+zfhcIlINVlPrqZTP+3RE
60OUpJd6QFc1tqRi2tVI+Hrx7JC1Xzn+Y3JwyBKF0KUuhhNAbOtsTdJU/V8+Jh9m
cajAuIWe9fV1j9qRTonjynh0MF8VCpmnyoM6djVI0NyLGiJOhaRO+kltK3C+jgwh
w2LMpNGtFmuae8tk/426QsMmqhV4aJzs9mvIDFcN5TgH02pXA50gDkvEe4GwKhz1
SupKmEn+Als9AxSQKH6a9HjQMYRX5Uw4ekIR4vUoUQNLIBW7Ihq28BUCAwEAAaOB
2TCB1jAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFIz02ZMKR7wAoErOS3VuoLaw
sn78MB8GA1UdIwQYMBaAFMB6mGiNifurBWQMEX2qfWW4ysxOMBIGA1UdEwEB/wQI
MAYBAf8CAQAwOgYDVR0fBDMwMTAvoC2gK4YpaHR0cDovL2NybC5nZW90cnVzdC5j
b20vY3Jscy9ndGdsb2JhbC5jcmwwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzAB
hhhodHRwOi8vb2NzcC5nZW90cnVzdC5jb20wDQYJKoZIhvcNAQEFBQADggEBADOR
NxHbQPnejLICiHevYyHBrbAN+qB4VqOC/btJXxRtyNxflNoRZnwekcW22G1PqvK/
ISh+UqKSeAhhaSH+LeyCGIT0043FiruKzF3mo7bMbq1vsw5h7onOEzRPSVX1ObuZ
lvD16lo8nBa9AlPwKg5BbuvvnvdwNs2AKnbIh+PrI7OWLOYdlF8cpOLNJDErBjgy
YWE5XIlMSB1CyWee0r9Y9/k3MbBn3Y0mNhp4GgkZPJMHcCrhfCn13mZXCxJeFu1e
vTezMGnGkqX2Gdgd+DYSuUuVlZzQzmwwpxb79k1ktl8qFJymyFWOIPllByTMOAVM
IIi0tWeUz12OYjf+xLQ=
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIFaDCCBFCgAwIBAgIDBo5UMA0GCSqGSIb3DQEBBQUAMGExCzAJBgNVBAYTAlVT
MRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMR0wGwYDVQQLExREb21haW4gVmFsaWRh
dGVkIFNTTDEbMBkGA1UEAxMSR2VvVHJ1c3QgRFYgU1NMIENBMB4XDTEzMDQyNTA4
NTEzNVoXDTE1MDQxNTA0NDcyOVowgdQxKTAnBgNVBAUTIHNZbkoyTG0tb2dGZnZC
aFlodWRqWVZIMndEek43MGdOMRMwEQYDVQQLEwpHVDU3NDYxMTU1MTEwLwYDVQQL
EyhTZWUgd3d3Lmdlb3RydXN0LmNvbS9yZXNvdXJjZXMvY3BzIChjKTEzMTcwNQYD
VQQLEy5Eb21haW4gQ29udHJvbCBWYWxpZGF0ZWQgLSBRdWlja1NTTChSKSBQcmVt
aXVtMSYwJAYDVQQDEx1jb3JwLXZzLWNhMi5wb3BtdWx0aW1lZGlhLmNvbTCCASIw
DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAM4jgpKBeo8rtM/zJIEyho3HppeU
tZeK+wmLfPeBTJxr2UmQFOmcniQblgsHREAGyJR0KT5yrYzxx6wpZaqCUcZlxl1Z
lUz5mfxHnL5Oc14sUnqwaJuxprXV5Rnclci6W6BMFjI4QoxXjQwSa+3A1enf+ZsO
sXUojQbQx62MX8rINuQ+srgdDielK/mJqTAMt11x6+NqIpwlGAgOxKd7vjG6aKRf
a2efvS/hK4Pi0ieWPGn1GXz/AlYpHQv0cppUr8huL/+2+9cEvd1sp8XN/ASN3YTm
WWo//fVpbXIlzp8mU4Q7t8+7LglxFQabhl4eMBarMi8SnNuh2zYKQxJRPvsCAwEA
AaOCAbMwggGvMB8GA1UdIwQYMBaAFIz02ZMKR7wAoErOS3VuoLawsn78MA4GA1Ud
DwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwKAYDVR0R
BCEwH4IdY29ycC12cy1jYTIucG9wbXVsdGltZWRpYS5jb20wQQYDVR0fBDowODA2
oDSgMoYwaHR0cDovL2d0c3NsZHYtY3JsLmdlb3RydXN0LmNvbS9jcmxzL2d0c3Ns
ZHYuY3JsMB0GA1UdDgQWBBSODVVgPunABo61x13N20tEP66egDAMBgNVHRMBAf8E
AjAAMHUGCCsGAQUFBwEBBGkwZzAsBggrBgEFBQcwAYYgaHR0cDovL2d0c3NsZHYt
b2NzcC5nZW90cnVzdC5jb20wNwYIKwYBBQUHMAKGK2h0dHA6Ly9ndHNzbGR2LWFp
YS5nZW90cnVzdC5jb20vZ3Rzc2xkdi5jcnQwTAYDVR0gBEUwQzBBBgpghkgBhvhF
AQc2MDMwMQYIKwYBBQUHAgEWJWh0dHA6Ly93d3cuZ2VvdHJ1c3QuY29tL3Jlc291
cmNlcy9jcHMwDQYJKoZIhvcNAQEFBQADggEBAC2Kadfzc6X/3dI//J5SGR9fnCa7
6NVl8SV5aAYAvmOdkZBiurIYa1eHYYaDUGmOO8awTOXTfc4QzX75QwBUmcZeZKdj
ZMPiJlm7Bsz/3Q1eolxHCqkAiDZIEohoT0o8Spw6+Eq8KcPnhf+K5+rIzJnWBZ9P
tmpS4SEtrGHIfj3+638eqTydxuOCZ0Be9EanVK0ERav25fTRgRoZ+yEDiFP/MjQd
rAgW7SyLOjm4I6bTmzjugmXf2Axm2kFuoyyZdrvdrJ+GBku5F6DOufGdGu13j80S
lp148qh7gCREWrCqn3pH14qPKeHwC47jAQ3+ikRDfB090h9HGRi/8+w7Tx4=
-----END CERTIFICATE-----

Best authentication method for controlling DEVICE access to wlan

Hello,
I have a similar question to this thread ( https://supportforums.cisco.com/message/3927713 ) but I'm interested about device control on top of user control. Just like that thread, we are using WPA2-AES Enterprise with PEAP MSCHAPv2, which allow users to log on with their domain credentials. We wanted something simple for our users, so MSCHAPv2 with "single sign on" was optimal to us.
Problem is, we have a new requirement and we need to implement it yesterday. We would like to allow only mobile devices and computers of our choice.
Since we are using MSCHAPv2 which allow every domain user to connect using any device as long as their domain credentials are valid, is there a simple way to control this ?
I guess we could go with MAC filtering, but we have about a thousand laptops. Not a big problem, we could do a regular MAC address inventory using SCCM. It's just that it looks like a brute force tactic to a simple problem. Would a Cisco ACE 4.1 RADIUS server tolerate well a MAC address table with a thousand entries ? What if it goes to two thousands ? Would this be easy to implement ? I'm a bit new to this, is there some documentation I could follow ?
How do people usually do this in an elegant way ? How do you manage and control WLAN access to thousands of device ? I guess they go with TLS with certificates ?
Thank you very much !
Konnan

Konnan,
Just saw your PM:)
Would it be possible to configure Access policies even if our Radius servers aren't joined to the domain ?
> I really don't know... typically all my installs have the radius server joined to the domain. I don't know what limitations you would have using the setup you currently are using.
Still wondering if it would be a good path for us, because of the computer authentication issue where it happens only at logon in Windows if I read correctly and our users don't have the habit to log off frequently and we use only manual connection mode when the user already has his session open. I guess MAR will have to be set to a stupid high value... if it even works.
> Well you need to sit down with everyone who is involved and really think out what works best for you. Machine authentication works well, but then people wonder what happens if someone logs in that isn't authorized and that because the computer is a domain computer it automatically gets on the network. Well your not going to get everything you want:) So PEAP has issue because IT wants to limit the user to only be able to access using a company owned device... well, then ISE is your fix. You can add a certificate that ISE can see and if that device has that or a registry value and the user is allowed to access the network, the authentication is allowed, or else it will not be. EAP-TLS... well more work since you need a PKI infrastructure and both the radius and the clients need a cert...
No matter what, you need to decide what works best and don't over complicate it with adding mac filter, etc.
I'm wondering if EAP-TLS wouldn't be better for the long term, maybe with MAC Address restriction on the short term...
> See above
I'm also wondering if we could stay with PEAP MSCHAPv2 but use an NPS Radius server from Microsoft which allow to use complex policies instead of the Cisco ACS Radius server...
> You need to know how to setup and configure the policies... either one will work, but if your on ACS 4.x, I would look at upgrading to 5.4. ISE is replacing ACS as far as the radius portion, but tacacs isn't yet available on ISE.
There's also the Cisco ISE, which seems to be equivalent to Microsoft NPS... a bit more costly OTOH.
> ISE allows you to profile devices so you know what device is accessing your network. Again, ISE is replacing ACS as far as the radius, but tacacs will soon be out and available for ISE. If you really want to create crazy profiles, then ISE is the way to go. You can specify that this user group is allowed wireless, but it has to be a domain computer. The user isn't allowed access if its not a domain computer. The same user group is allowed access with company iPads (certificate installed), but not have access with personal iPads, tablets or smartphones.
Hope this helps.
Thanks,
Scott
Help out other by using the rating system and marking answered questions as "Answered"

VDI and other authentication methods

hello,
I want to set VDI 3 and i know you need AD/LDAP for a production environment.
I was wondering if in any way there is/(will be) an open framework for other authentication methods,
for instance like HESIOD?
thanks
Michael.

Since you disabled "clear", you will need to configure SquirrelMail to use Cram-MD5.
To do so run:
sudo /etc/squirrelmail/config/conf.pl
and adjust your IMAP and SMTP settings

HTTP Authentication Methods

Testing HTTP Authentication Methods for URL https://mail.domain.co.nz/rpc/rpcproxy.dll?cl-cas01.domain.local:6002.
The HTTP authentication test failed.
Tell me more about this issue and how to resolve it
Additional Details
Not all the required authentication methods were found.
Methods Found: Negotiate
Methods Required: NTLM
Any ideas how to get around this with the exchange connectivity tester? If I change from negotiate to basic or ntlm, I then have issues with clients on the local network.

This link does not work. Could you update this post with the information that helped fix your issue? I am receiving the same error. Everything works internally. I have a casarray with 3 client access servers. If I try and connect using Outlook Anywhere externally,
all the tests pass except for the last one which states:
Testing HTTP Authentication Methods for URL https://casarray.mydomain.com/rpc/rpcproxy.dll?casarray.mydomain.com:6002.
The HTTP authentication test failed.
Additional Details
An HTTP 500 response was returned from Unknown.
HTTP Response Headers:
Content-Length: 3423
Cache-Control: private
Content-Type: text/html; charset=utf-8
Date: Tue, 03 Jun 2014 01:59:11 GMT
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Elapsed Time: 2135 ms.
Here is the full test:
Testing RPC/HTTP connectivity.
The RPC/HTTP test failed.
Additional Details
Elapsed Time: 10139 ms.
Test Steps
Attempting to resolve the host name casarray.mydomain.com in DNS.
The host name resolved successfully.
Additional Details
IP addresses returned: MyIpAddress
Elapsed Time: 262 ms.
Testing TCP port 443 on host casarray.mydomain.com to ensure it's listening and open.
The port was opened successfully.
Additional Details
Elapsed Time: 213 ms.
Testing the SSL certificate to make sure it's valid.
The certificate passed all validation requirements.
Additional Details
Elapsed Time: 1347 ms.
Test Steps
The Microsoft Connectivity Analyzer is attempting to obtain the SSL certificate from remote server casarray.mydomain.com on port 443.
The Microsoft Connectivity Analyzer successfully obtained the remote SSL certificate.
Additional Details
Remote Certificate Subject: CN=casarray.mydomain.com, OU=Domain Control Validated - RapidSSL(R), OU=See www.rapidssl.com/resources/cps (c)14, OU=GT62161020, SERIALNUMBER=4/00u9cheL7q8Gq41IXnlvVd8mb8-rjb, Issuer: CN=RapidSSL CA, O="GeoTrust, Inc.", C=US.
Elapsed Time: 1260 ms.
Validating the certificate name.
The certificate name was validated successfully.
Additional Details
Host name casarray.mydomain.com was found in the Certificate Subject Common name.
Elapsed Time: 0 ms.
Certificate trust is being validated.
The certificate is trusted and all certificates are present in the chain.
Test Steps
The Microsoft Connectivity Analyzer is attempting to build certificate chains for certificate CN=casarray.mydomain.com, OU=Domain Control Validated - RapidSSL(R), OU=See www.rapidssl.com/resources/cps (c)14, OU=GT62161020, SERIALNUMBER=4/00u9cheL7q8Gq41IXnlvVd8mb8-rjb.
One or more certificate chains were constructed successfully.
Additional Details
A total of 1 chains were built. The highest quality chain ends in root certificate CN=GeoTrust Global CA, O=GeoTrust Inc., C=US.
Elapsed Time: 32 ms.
Analyzing the certificate chains for compatibility problems with versions of Windows.
Potential compatibility problems were identified with some versions of Windows.
Additional Details
The Microsoft Connectivity Analyzer can only validate the certificate chain using the Root Certificate Update functionality from Windows Update. Your certificate may not be trusted on Windows if the "Update Root Certificates" feature isn't enabled.
Elapsed Time: 4 ms.
Testing the certificate date to confirm the certificate is valid.
Date validation passed. The certificate hasn't expired.
Additional Details
The certificate is valid. NotBefore = 5/6/2014 10:15:31 AM, NotAfter = 5/9/2015 5:16:00 PM
Elapsed Time: 0 ms.
Checking the IIS configuration for client certificate authentication.
Client certificate authentication wasn't detected.
Additional Details
Accept/Require Client Certificates isn't configured.
Elapsed Time: 6179 ms.
Testing HTTP Authentication Methods for URL https://casarray.mydomain.com/rpc/rpcproxy.dll?casarray.mydomain.com:6002.
The HTTP authentication test failed.
Additional Details
An HTTP 500 response was returned from Unknown.
HTTP Response Headers:
Content-Length: 3423
Cache-Control: private
Content-Type: text/html; charset=utf-8
Date: Tue, 03 Jun 2014 01:59:11 GMT
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Elapsed Time: 2135 ms.

Backup authentication method

Hello everybody,
I would like to set up a few computers to authenticate to a Network Account Server, and would like to know if there is a way to set a backup authentication method, for when the users are not connected to the same network as the server.
Is there a way to set up the primary authentication method to be with the server, and if the server is not reachable, to use the internal user database?
Thank you in advance.

You are talking about two different account types. Apple supports a variety but there is a distinction between mobile account and network home accounts.
Mobile accounts are user accounts in which the account attributes (user name, password, etc) exist in OD on the server and are (optionally) cached to the workstation/laptop for offline use. The user's home folder is on the workstation/laptop. Only the account attributes exist on the server. This allows for centralized account management that cascades to the workstations.
Network home folders are exactly what they sound like. The account attributes and the user data is on the server. This is more difficult to support and really is most effective in education where device sharing is required and users have short duration use.
What I imagine you are looking to do is set up an Mac server in one location as the master. Then the second is set up in the second location and it is an OD Replica. This will allow user accounts to be created on one server and pushed to the other server automatically. Please note, you will need to explicitly allow access to services on the replica.
If you want to get fancy, define locales so the systems will auth to the nearest server.
Also, if your two servers are in two different locations, make sure you are using a VPN tunnel between the locations. Don't try to replicate by using port forwarding.
Reid
Apple Consultants Network
Apple Professional Services
Author "Mavericks Server – Foundation Services" :: Exclusively available in Apple's iBooks Store

Authentication methods

Hello,
I am trying to connect smtp of exchange 2007 server. Below one.
I am getting client was not authenticated error while sending message.
ehlo
250-server name
250-SIZE 10485760
250-PIPELINING
250-DSN
250-ENHANCEDSTATUSCODES
250-STARTTLS
250-AUTH GSSAPI NTLM
250-8BITMIME
250-BINARYMIME
250 CHUNKINGbelow is the sample code i am trying..
import java.util.Properties;
import javax.mail.*;
import javax.mail.internet.InternetAddress;
import javax.mail.internet.MimeMessage;
public class SendMailExchange {
     public boolean sendMail() {
          try {
               String from = "email";
               String to = "email";
               String host = "servername";
               String username = "sumant_chhunchha";
               String password = "password";
               Properties p = System.getProperties();
               //p.put("mail.smtp.host", host);
               p.put("mail.transport.protocol", "smtp");
               p.put("mail.smtp.port", "25");
               p.put("mail.smtp.auth", "true");
          //     p.put("mail.smtp.allow8bitmime", "true");
          //     p.put("mail.smtp.auth.mechanisms", "GSSAPI NTLM");
          //     p.put("mail.smtp.starttls.enable","true");
          //     p.put("mail.smtp.starttls.required","true");
                    Authenticator auth = new SMTPAuthenticator(username, password);
               Session session = Session.getInstance(p, auth);
               // Session session = Session.getInstance(p);
               session.setDebug(true);
               MimeMessage message = new MimeMessage(session);
               message.setFrom(new InternetAddress(from));
               message.addRecipient(Message.RecipientType.TO, new InternetAddress(to));
               message.setSubject("Hello JavaMail");
               message.setText("Welcome to JavaMail");
               message.saveChanges();
               // Send message
               Transport transport = session.getTransport("smtp");
               transport.connect(host, username, password);
               transport.sendMessage(message, message.getAllRecipients());
               transport.close();
               // Transport.send(message);
          } catch (Exception e) {
               e.printStackTrace();
               return false;
          return true;
     public static void main(String args[]) {
          new SendMailExchange().sendMail();
     class SMTPAuthenticator extends Authenticator {
          String username;
          String password;
          public SMTPAuthenticator(String username, String password) {
               super();
               this.username = username;
               this.password = password;
          public PasswordAuthentication getPasswordAuthentication(
                    String username, String password) {
               return new PasswordAuthentication(username, password);
}I have just kept commented code to show what else I have tried.
session debug trace as below
DEBUG: setDebug: JavaMail version 1.4ea
DEBUG: getProvider() returning javax.mail.Provider[TRANSPORT,smtp,com.sun.mail.smtp.SMTPTransport,Sun Microsystems, Inc]
DEBUG SMTP: useEhlo true, useAuth false
DEBUG SMTP: trying to connect to host "server name", port 25, isSSL false
220 server_name Microsoft ESMTP MAIL Service ready at Mon, 11 May 2009 16:20:24 +0530
DEBUG SMTP: connected to host "server_name", port: 25
EHLO ps5609
250-server name
250-SIZE 10485760
250-PIPELINING
250-DSN
250-ENHANCEDSTATUSCODES
250-STARTTLS
250-AUTH GSSAPI NTLM
250-8BITMIME
250-BINARYMIME
250 CHUNKING
DEBUG SMTP: Found extension "SIZE", arg "10485760"
DEBUG SMTP: Found extension "PIPELINING", arg ""
DEBUG SMTP: Found extension "DSN", arg ""
DEBUG SMTP: Found extension "ENHANCEDSTATUSCODES", arg ""
DEBUG SMTP: Found extension "STARTTLS", arg ""
DEBUG SMTP: Found extension "AUTH", arg "GSSAPI NTLM"
DEBUG SMTP: Found extension "8BITMIME", arg ""
DEBUG SMTP: Found extension "BINARYMIME", arg ""
DEBUG SMTP: Found extension "CHUNKING", arg ""
DEBUG SMTP: use8bit false
MAIL FROM:<email>
530 5.7.1 Client was not authenticated
com.sun.mail.smtp.SMTPSendFailedException: 530 5.7.1 Client was not authenticated
com.sun.mail.smtp.SMTPSendFailedException: 530 5.7.1 Client was not authenticated
     at com.sun.mail.smtp.SMTPTransport.issueSendCommand(SMTPTransport.java:1388)
     at com.sun.mail.smtp.SMTPTransport.mailFrom(SMTPTransport.java:959)
     at com.sun.mail.smtp.SMTPTransport.sendMessage(SMTPTransport.java:583)
     at SendMailExchange.sendMail(SendMailExchange.java:57)
     at SendMailExchange.main(SendMailExchange.java:68)
     at com.sun.mail.smtp.SMTPTransport.issueSendCommand(SMTPTransport.java:1388)
     at com.sun.mail.smtp.SMTPTransport.mailFrom(SMTPTransport.java:959)
     at com.sun.mail.smtp.SMTPTransport.sendMessage(SMTPTransport.java:583)
     at SendMailExchange.sendMail(SendMailExchange.java:57)
     at SendMailExchange.main(SendMailExchange.java:68)what all authentication methods for smtp is supported?
thanks
-sumant

ohh sorry for that...I might have updated some old trace...
here with smtp.auth - true...
DEBUG: setDebug: JavaMail version 1.4ea
DEBUG: getProvider() returning javax.mail.Provider[TRANSPORT,smtp,com.sun.mail.smtp.SMTPTransport,Sun Microsystems, Inc]
DEBUG SMTP: useEhlo true, useAuth true
DEBUG SMTP: trying to connect to host "server_name", port 25, isSSL false
220 server_name Microsoft ESMTP MAIL Service ready at Tue, 12 May 2009 12:19:53 +0530
DEBUG SMTP: connected to host "server_name", port: 25
EHLO ps5609
250-server_name Hello [ip]
250-SIZE 10485760
250-PIPELINING
250-DSN
250-ENHANCEDSTATUSCODES
250-STARTTLS
250-AUTH GSSAPI NTLM
250-8BITMIME
250-BINARYMIME
250 CHUNKING
DEBUG SMTP: Found extension "SIZE", arg "10485760"
DEBUG SMTP: Found extension "PIPELINING", arg ""
DEBUG SMTP: Found extension "DSN", arg ""
DEBUG SMTP: Found extension "ENHANCEDSTATUSCODES", arg ""
DEBUG SMTP: Found extension "STARTTLS", arg ""
DEBUG SMTP: Found extension "AUTH", arg "GSSAPI NTLM"
DEBUG SMTP: Found extension "8BITMIME", arg ""
DEBUG SMTP: Found extension "BINARYMIME", arg ""
DEBUG SMTP: Found extension "CHUNKING", arg ""
DEBUG SMTP: Attempt to authenticate
DEBUG SMTP: use8bit false
MAIL FROM:<sumant_chhunchha@domain>
530 5.7.1 Client was not authenticated
com.sun.mail.smtp.SMTPSendFailedException: 530 5.7.1 Client was not authenticated
     at com.sun.mail.smtp.SMTPTransport.issueSendCommand(SMTPTransport.java:1388)
     at com.sun.mail.smtp.SMTPTransport.mailFrom(SMTPTransport.java:959)
     at com.sun.mail.smtp.SMTPTransport.sendMessage(SMTPTransport.java:583)
     at SendMailExchange.sendMail(SendMailExchange.java:57)
     at SendMailExchange.main(SendMailExchange.java:68)
com.sun.mail.smtp.SMTPSendFailedException: 530 5.7.1 Client was not authenticated
     at com.sun.mail.smtp.SMTPTransport.issueSendCommand(SMTPTransport.java:1388)
     at com.sun.mail.smtp.SMTPTransport.mailFrom(SMTPTransport.java:959)
     at com.sun.mail.smtp.SMTPTransport.sendMessage(SMTPTransport.java:583)
     at SendMailExchange.sendMail(SendMailExchange.java:57)
     at SendMailExchange.main(SendMailExchange.java:68)thanks
-sumant

Cisco ISE User Authentication Certificates for Wired and Wirless Users (BYOD)

Can any one tell me from where we can purchase User Authentication Certificates for Wired and Wireless Users (BYOD) for Cisco ISE. Also Confirm what certificates we required for the purpose.
Please suggest the Website form where we can purchase and ipmort in Cisco ISE certificate Section.
Thanks.

Dear Mohana,
Thanks for your reply, Can you please confirm me in regards EAP-TLS certificate, which authorities you recomend if i go to Go dadday or very Sign to buy it and then import in ISE.
Looking forward for your reply.
Regards,
Muhammad Imran Shaikh
Resident Engineer, IT Network Section - PPL
Mobile : 0092-312-288-1010
LinkedIn : pk.linkedin.com/pub/muhammad-imran-shaikh/10/471/b47/

Configuring the authentication scheme for a web application

Hi all,
We have a requirement to configure the authentication scheme for a web application where some set of users should access the application using basic LDAP (userid/password) authentication and some using digital certificate authentication.
Since the deployment descriptor (web.xml) allows only one directive for auth-method in logic-config, we want to know if there is any other way to achieve this requirement. We are thinking of a custom login module approach. But we are not able to figure out how to configure the auth-method at runtime from the login servlet.
Please let us know if there is any other approach to achieve this.
I will be thankful if any body shares any specific solution to this issue.

This forum is probably not the correct one to ask in. It's more related to the web container than Java Programming.
Kaj

How to use an authenticated user for a proxy call

Dear all,
I am currently working on a JEE application where the user needs to authenticate (for this I have configured the web.xml).
Now inside this application I need to do a proxy call to a PI webservice.
I would like to use the user credentials of the already logged in user in order to call the proxy.
What I don't want to do is to use a service user for the proxy call.
The code I am trying to call looks something like this:
     private IntegratedConfigurationIn getPort() throws Exception{
          IntegratedConfigurationIn port = null;
          try {
               IntegratedConfigurationInService service = null;
               service = new IntegratedConfigurationInService();
               port = (IntegratedConfigurationIn) service.getIntegratedConfigurationIn_Port();
              BindingProvider bp = (BindingProvider)port;
              bp.getRequestContext().put(BindingProvider.USERNAME_PROPERTY, user);
              bp.getRequestContext().put(BindingProvider.PASSWORD_PROPERTY, password);
              if (url.length() != 0)
                   bp.getRequestContext().put(BindingProvider.ENDPOINT_ADDRESS_PROPERTY, url);
          catch (Exception ex){
               ex.printStackTrace();
          return port;
The examples I found to retrieve the userdata pointed to codes similar to this one:
public HttpServletRequest getHttpRequest() throws Exception {
          // Get runtime context
          Properties props = new Properties();
          props.put("domain", "true");
          Context initialContext = new InitialContext(props);
          ApplicationWebServiceContext wsContext = (ApplicationWebServiceContext) initialContext
                    .lookup(" /wsContext/ApplicationWebServiceContext");
          HttpServletRequest req = wsContext.getHttpServletRequest();
          return req;
com.sap.security.api.IUser sapUser = com.sap.security.api.UMFactory.getAuthenticator().getLoggedInUser(getHttpRequest(), null);
          IUser ep5User = com.sapportals.wcm.util.usermanagement.WPUMFactory.getUserFactory().getEP5User(sapUser);
Now I don't know how to bring it togehter and how to use an authenticated user for the BindingProvider.
I would appreciate any hints or ideas.

Peter,
from the first screenshot, what I understood is that, you are calling an inbound PI web service that is intended to create an integrated configuration object (this is used for whole lot of other reason completely) but not actually calling a development web service.
For this, you would have to generate your client classes from the WSDL provided by the PI developer for that particular service. Once you get those client classes generated, you could used the method provided in the other screenshot to extract the user and password and call the intended web service.
Vijay Konam

ERROR: Ldap Authentication failed for dap during installation of iAS 6.0 SP3

I am attempting to install ias Enterprise Edition (6.0 SP3) on solaris 2.8 using typical in basesetup. I am trying to install new Directory server as I don't have an existing one.
During the installation I got the following error.
ERROR: Ldap Authentication failed for url ldap://hostname:389/o=NetScape Root user id admin (151: Unknown Error)
Fatal Slapd did not add Directory server information to config Server.
Warning slapd could'nt populate with ldif file Yes error code 151.
ERROR:Failure installing iPlanet Directory Server.
Do you want to continue: ( I entered yes )
Configuring Administration Server Segmentation fault core dumped.
Error: Failure installing Netscape Administration Server.
Do you want to continue:( I responded with yes).
And during the Extraction I got the following
ERROR:mple_bind: Can't connect to the LDAP server - No route to host
ERROR: Unable to connect to LDAP Directory Server
Hostname: hostname
Port: 389
User: cn=Directory Manager
Password: <password-for-cn=Directory Manager
Please make sure this Directory Server is currently running.
You might need to run 'stop-slapd' and then
'start-slapd' in the Directory Server home directory, in order to restart
LDAP. When finished, press ENTER to continue, or S to skip this step:
Start registering Bootstrap EJB...
javax.naming.NameNotFoundException
at java.lang.Throwable.fillInStackTrace(Native Method)
at java.lang.Throwable.fillInStackTrace(Compiled Code)
at java.lang.Throwable.<init>(Compiled Code)
at java.lang.Exception.<init>(Compiled > Code)
at javax.naming.NamingException.<init>(NamingException.java:114)
at javax.naming.NameNotFoundException.<init>(NameNotFoundException.java: 48)
at com.netscape.server.jndi.RootContext.resolveCtx(Unknown Source)
"ldaperror" 76 lines, 2944 characters
at com.netscape.server.jndi.RootContext.resolveCtx(Unknown Source)
at com.netscape.server.jndi.RootContext.bind(Unknown Source)
at com.netscape.server.jndi.RootContext.bind(Unknown Source)
at javax.naming.InitialContext.bind(InitialContext.java:371)
at com.netscape.server.deployment.EjbReg.deployToNaming(Unknown Source)
at com.netscape.server.deployment.EjbReg.registerEjbJar(Compiled Code)
at com.netscape.server.deployment.EjbReg.registerEjbJar(Compiled Code)
at com.netscape.server.deployment.EjbReg.run(Compiled Code)
at com.netscape.server.deployment.EjbReg.main(Unknown Source)
Start registering iAS 60 Fortune Application...
Start iPlanet Application Server
Start iPlanet Application Server
Start Web Server iPlanet-WebServer-Enterprise/6.0SP1 B08/20/200100:58
warning: daemon is running as super-user
[LS ls1] http://gedemo1.plateau.com, port 80 ready
to accept requests
startup: server started successfully.
After completion of installation, I tried to start the console. But I got the following error;
"Cant connect ot the admin server. The url is not correct or the server is not running.
Finally,when I started the admintool(iASTT),it shows the iAS1
was registered( marked with a red cross mark) and says "cant login. make sure the user
name & passwdord are correct" when i click on it.
Thanks in advance for any help
Madhavi

Hi,
Make sure that the directory server is installed first. If it is running
ok, then you can try adding an admin user, please check the following
technote.
http://knowledgebase.iplanet.com/ikb/kb/articles/4106.html
regards
Swami
madhavi korupolu wrote:
I am attempting to install ias Enterprise Edition (6.0 SP3) on
solaris 2.8 using typical in basesetup. I am trying to install new
Directory server as I don't have an existing one.
During the installation I got the following error.
ERROR: Ldap Authentication failed for url
ldap://hostname:389/o=NetScape Root user id admin (151: Unknown
Error)
Fatal Slapd did not add Directory server information to config
Server.
Warning slapd could'nt populate with ldif file Yes error code 151.
ERROR:Failure installing iPlanet Directory Server.
Do you want to continue: ( I entered yes )
Configuring Administration Server Segmentation fault core dumped.
Error: Failure installing Netscape Administration Server.
Do you want to continue:( I responded with yes).
And during the Extraction I got the following
ERROR:mple_bind: Can't connect to the LDAP server - No route to host
ERROR: Unable to connect to LDAP Directory Server
Hostname: hostname
Port: 389
User: cn=Directory Manager
Password: <password-for-cn=Directory Manager
Please make sure this Directory Server is currently running.
You might need to run 'stop-slapd' and then
'start-slapd' in the Directory Server home directory, in order to
restart
LDAP. When finished, press ENTER to continue, or S to skip this
step:
Start registering Bootstrap EJB...
javax.naming.NameNotFoundException
at java.lang.Throwable.fillInStackTrace(Native Method)
at java.lang.Throwable.fillInStackTrace(Compiled Code)
at java.lang.Throwable.<init>(Compiled Code)
at java.lang.Exception.<init>(Compiled > Code)
at javax.naming.NamingException.<init>(NamingException.java:114)
at
javax.naming.NameNotFoundException.<init>(NameNotFoundException.java:
48)
at com.netscape.server.jndi.RootContext.resolveCtx(Unknown Source)
"ldaperror" 76 lines, 2944 characters
at com.netscape.server.jndi.RootContext.resolveCtx(Unknown Source)
at com.netscape.server.jndi.RootContext.bind(Unknown Source)
at com.netscape.server.jndi.RootContext.bind(Unknown Source)
at javax.naming.InitialContext.bind(InitialContext.java:371)
at com.netscape.server.deployment.EjbReg.deployToNaming(Unknown
Source)
at com.netscape.server.deployment.EjbReg.registerEjbJar(Compiled
Code)
at com.netscape.server.deployment.EjbReg.registerEjbJar(Compiled
Code)
at com.netscape.server.deployment.EjbReg.run(Compiled Code)
at com.netscape.server.deployment.EjbReg.main(Unknown Source)
Start registering iAS 60 Fortune Application...
Start iPlanet Application Server
Start iPlanet Application Server
Start Web Server iPlanet-WebServer-Enterprise/6.0SP1 B08/20/200100:58
warning: daemon is running as super-user
[LS ls1] http://gedemo1.plateau.com, port 80 ready
to accept requests
startup: server started successfully.
After completion of installation, I tried to start the console. But I
got the following error;
"Cant connect ot the admin server. The url is not correct or the
server is not running.
Finally,when I started the admintool(iASTT),it shows the iAS1
was registered( marked with a red cross mark) and says "cant login.
make sure the user
name & passwdord are correct" when i click on it.
Thanks in advance for any help
Madhavi
Try our New Web Based Forum at http://softwareforum.sun.com
Includes Access to our Product Knowledge Base!

Ask the Expert: Integrating Cisco Identity Service Engine (ISE) 1.2 for BYOD

With Eric Yu and Todd Pula
Welcome to the Cisco Support Community Ask the Expert conversation. This is an opportunity to learn and ask questions about integrating Cisco ISE 1.2 for BYOD with experts Eric Yu and Todd Pula.
Cisco Bring Your Own Device (BYOD) is an end-to-end architecture that orchestrates the integration of Cisco's mobile and security architectures to various third-party components. The session takes a deep dive into the available tools and methodologies for troubleshooting the Cisco BYOD solution to identify root causes for problems that stem from mobile device manager integration, Microsoft Active Directory and certificate authority services, and Cisco Enterprise Mobility integration to the Cisco Identity Services Engine (ISE).
Todd and Eric recently delivered a technical workshop that helps network designers and network engineers understand integration of the various Cisco BYOD components by taking a deep dive to analyze best practice configurations and time-saving troubleshooting methodologies. The content consisted of common troubleshooting scenarios in which TAC engineers help customers address operational challenges as seen in real Cisco BYOD deployments.
Eric Yu is a technical leader at Cisco responsible for supporting our leading-edge borderless network solutions. He has 10 years of experience in the telecommunications industry designing data and voice networks. Previous to his current role, he worked as a network consulting engineer for Cisco Advance Services, responsible for designing and implementing Cisco Unified Communications for Fortune 500 enterprises. Before joining Cisco, he worked at Verizon Business as an integration engineer responsible for developing a managed services solution for Cisco Unified Communications. Eric holds CCIE certification in routing and switching no. 14590 and has two patents pending related to Cisco's medianet.
Todd Pula is a member of the TAC Security and NMS Technical Leadership team supporting the ISE and intrusion prevention system (IPS) product lines. Todd has 15 years of experience in the networking and information security industries, with 6 years of experience working in Cisco's TAC organization. Previous to his current role, Todd was a TAC team lead providing focused technical support on Cisco's wide array of VPN products. Before joining Cisco, he worked at Stanley Black & Decker as a network engineer responsible for the design, configuration, and support of an expansive global network infrastructure. Todd holds his CCIE in routing and switching no. 19383 and an MS degree in IT from Capella University.
Remember to use the rating system to let Eric and Todd know if you have received an adequate response.
Because of the volume expected during this event, Eric and Todd might not be able to answer every question. Remember that you can continue the conversation in the Security community, subcommunity AAA, Identity and NAC, shortly after the event. This event lasts through November 15, 2013. Visit this forum often to view responses to your questions and the questions of other Cisco Support Community members.

Hi Antonio,
Many great questions to start this series. For the situation that you are observing with your FlexConnect configuration, is the problem 100% reproducible or is it intermittent? Does the problem happen for one WLAN but not another? As it stands today, the CoA-Ack needs to be initiated by the management interface. This limitation is documented in bug CSCuj42870. I have provided a link for your reference below. If the problem happens 100% of the time, the two configuration areas that I would check first include:
On the WLC, navigate to Security > RADIUS > Authentication. Click on the server index number for the associated ISE node. On the edit screen, verify that the Support for RFC 3576 option is enabled.
On the WLC, navigate to the WLANs tab and click on the WLAN ID for the WLAN in question. On the edit screen, navigate to Security > AAA and make sure the Radius Server Overwrite interface is unchecked. When this option is checked, the WLC will attemp to send client authentication requests and the CoA-Ack/Nak via the dynamic interface assigned to the WLAN vs. the management interface. Because of the below referenced bug, all RADIUS packets except the CoA-Ack/Nak will actually be transmitted via the dynamic interface. As a general rule of thumb, if using the Radius NAC option on a WLAN, you should not configure the Radius Server Overwrite interface feature.
Bug Info: https://tools.cisco.com/bugsearch/bug/CSCuj42870
For your second question, you raise a very valid point which I am going to turn into a documentation enhancement request. We don't currently have a document that lists the possible supplicant provisioning wizard errors that may be encountered. Please feel free to post specific errors that you have questions about in this chat and we will try to get you answers. For most Android devices, the wizard log file can be found at /sdcards/downloads/spw.log.
As for product roadmap questions, we won't be able to discuss this here due to NDA. Both are popular asks from the field so it will be interesting to see what the product marketing team comes up with for the next iterration of ISE.
Related Info:
Wireless BYOD for FlexConnect Deployment Guide

J_security_check users from MySQL (or a similar authentication method)?

After trying to write an authentication system using sessions (and failing), I did some research and found out about j_security_check.
After searching for ways to use this and coming across several forum posts that never seemed to accomplish anything close to what I'm attempting to do, the closest method for doing this would only get user data from the tomcat-users.xml file.
Normally, this would work, but I'm aiming for a way to allow users to register, and a SQL database seems like the best way to do this. (plus, I don't want to mess around with file permissions and such)
Is reading the user data from MySQL possible? If not, is there a decent way to accomplish something close to this (that works with Tomcat 6- all the guides I read seemed to refer to SJSAS-specific features)?
Thanks!
Also, here's the code I'm currently using from web.xml if that helps at all:
<login-config>
        <auth-method>FORM</auth-method>
        <realm-name>CMS Login</realm-name>
        <form-login-config>
            <form-login-page>/index.jsp?page=pages/login/login.jspf</form-login-page>
            <form-error-page>/index.jsp?page=pages/login/error.jspf</form-error-page>
        </form-login-config>
    </login-config>

Yes you can store the usernames passwords anywhere you want to.
In Tomcat they refer to this "database" of usernames/passwords as a Realm
http://tomcat.apache.org/tomcat-6.0-doc/realm-howto.html
The default implementation is the MemoryRealm which reads from that tomcat-users.xml file.
You can instead use a JDBCRealm or DatasourceRealm (Better IMO) to locate the usernames/passwords. It just requires configuration of the server.
Cheers,
evnafets

Authentication failed because Outlook doesn't support any of the available authentication methods.

When attempting to check and send email from my Mac via iCloud, I keep getting the error "Authentication failed because Outlook doesn't support any of the available authentication methods." I have change just about everything I can see available, but continue to get this message.
I am able to send email via iCloud using my .Me and .Mac adresses, and that tells me that it is not able to store "sent emails" on iCluud and will store them loaclly on my computer. I can handle this, but whem going to iCloud Web page haave nothing withing the "sent" mailbox.
Using OS 10.7.2, and Outlook 2011 version 14.1.3
Thanks in advance......

I got the following from the microsoft Web site. Also, the SMPT port must be overwriten. Use port 587
This article contains information about the compatibility of Microsoft Outlook for Mac 2011 and Apple iCloud. Outlook for Mac 2011 does not support Apple iCloud calendar (CalDAV) and contact (CardDAV) synchronization. Outlook for Mac 2011 does support iCloud Mail. For steps on how to configure your iCloud email account in Outlook for Mac 2011, go to the "More Information" section of this article.
To configure your Apple iCloud email account in Microsoft Outlook for Mac 2011, follow these steps:
Start Outlook 2011.
On the Tools menu, click Accounts.
Click the plus sign in the lower-left corner, and then select E-mail.
Enter your E-mail Address and Password, and then click Add Account.
Note: The new account will appear in the left navigation pane of the Accounts dialog box.
Enter one of the following in the Incoming server box:
mail.me.com (for me.com mail addresses)
mail.mac.com (for mac.com mail addresses)
Click to select Use SSL to connect (recommended) under the Incoming server box.
Enter one of the following in the Outgoing server box:
smtp.me.com (for me.com mail addresses)
smtp.mac.com (for mac.com mail addresses)
Click to select Use SSL to connect (recommended) under the Outgoing server box.
After you have entered the incoming and outgoing server information, Outlook 2011 will start to receive your email messages.
Note: You can click Advanced to enter additional settings, such as leaving a copy of each message on the server.

Authentication methods for BYOD senario?

Similar Messages

Maybe you are looking for