Bypass PEAP user authentication

Hello.
We use PEAP/MSCHAPv2 for client AND user authentication. Wireless users and clients will be authenticated by the ACS by asking a ADS usergroup membership. Only authenticated users on authenticated clients should have access to LAN ressources protected by the wlan controller. If the wireless client use the WZC and the logged on user is not a member of the user group he will not be authenticated and blocked by the wlan controller. But if the wireless client use the actual "Intel Wireless Pro Set" AND the user is not a member of the ADS group the ACS drop the user authentication request, but few seconds later the user will have nevertheless access to internal resources.
In this case I think the user authentication request will not right handled by the ACS so authenticated client will have access through the wlan controller and a not ACS authenticated user will have access to lan ressources by his local cached user credentials.
Is there a possible security leak or have I a configuration problem?
Best regards
Olaf Bachmann

This is not a security leak but a configuration issue. If the client utility and the ACS, ADS database is correctly configured then you will not see any issues.

Similar Messages

  • New Intel Wireless Pro set let bypass PEAP user authentication

    Hello.
    I have a critical situation. We use PEAP/MSCHAPv2 for client and user authentication. Wireless users and clients will be authenticated by the ACS by asking a ADS usergroup membership. Valid users and clients have access to LAN ressources protected by the wlan controller. If the wireless client use the WZC and the logged on user is not a member of the user group he will not be authenticated and have no access through the wlan controller. But if the wireless client can use the actual "Intel Wireless Pro Set" and the user is not a member of the ADS group the ACS drop the user authentication request. But some seconds later the user will have nevertheless access to internal resources.
    In this case I think the user authentication request will not right handled by the ACS so authenticated client will have access through the wlan controller and a not ACS authenticated user will have access to lan ressources by his local cached user credentials.
    Is there a possible security leak or have I a configuration problem?
    Best regards
    Olaf Bachmann

    Hi irisrios.
    PEAP "Fast Reconect" is disabled on ACS side.
    But in the meantime we made some tests with cisco ACS and nortel wlan controller. If the wlan client use a wireless profile, generated with the Intel Proset (!! full installation incl. andmin tools and pre-logon authentication!!) then a user who is not a member of the wlan user group have access to lan resources.

  • Wireless PEAP users authenticated by TACACS+

    Hello,
    I have the following scenario, access points 1214 (fat AP) connected to ACS (RADIUS) and the ACS integrated with Novell LDAP as external database.
    The wireless users use PEAP for authentication, here the problem when I tried to connect wirelessly with username and password configured locally on the ACS database it works fine but if I use a username and password listed on the Novell LDAP I got the error ?Auth type not supported by External DB? .
    Note:
    For VPN users, I can connect and access the network resources from outside with username and password listed on Novell LDAP database (integration between ACS and Novell LDAP is fine). Maybe this note could help you!!
    Regards,
    Belal

    Hello Darran,
    Thx for your feedback..
    now i'm trying to configure EAP-TLS but as stated in the configuration guide i should have CA certificates for both ACS and the wireless users. here the question, shall i have CA server or thers is another way to complete the task (use local generated certificate for example if possible) ?
    Regards,
    Belal

  • Problems with 802.1x MS PEAP machine and user authentication

    Using Microsoft PEAP 802.1x client on Windows XP SP2, if we enable machine authentication against a Windows Domain, the machine authentication is successful and the machine gets access to the network. However, when user logon occurs to the domain, contrary to the flow given in ACS and Windows documentation, no user authentication takes place.
    We need to differentiate user access based on their identities. We need machine authentication only to allow users access to the domain controller and also GP implementation.
    Any idea why user does not get prompted when they logon. 802.1x is configured in users profile and I have tried with both integrated and non-integrated with Domain logon (i.e. "use my windows logon name and password and domain (if any) option"
    There is no record of any identity request/response in ACS after the initial machine authentication (which appears in successful authentication log)
    We are using MS-CHAPv2.

    Update...The problem of cached credentials in MS PEAP does not occur if "enable logon using Windows username and password (and domain if any) is checked. Using this option, MS PEAP always uses logged on users most current credentials.
    However, using this option sends the username as "DOMAIN\USERNAME". Since we are using ACS internal database for user authentication (even though the ACS and Windows passwords are same - using an identity management system) ACS does not recognize the user.
    I have tried proxy distribution with prefix stripping but it does not seem to work when it is pointing to the same ACS server on which proxy distribution is configured and which receives the request.
    Any idea how the domain\ can be ignored by ACS?

  • Bypass user authentication

    We have setup Proxy 3.6 for user authentication through LDAP (using Directory Server 5.1). We need to bypass authentication for certain URLs. While we have achieved this using regular expressions, there are some sites using images, scripts etc from other external URLs and so we get prompted to enter username/password. Of course we can create new regex for these external URLs also, but the question is: if there is a more elegant way to avoid this i.e. when we visit such a URL to get all the content without bothering about external links etc.
    Thx

    This is not a security leak but a configuration issue. If the client utility and the ACS, ADS database is correctly configured then you will not see any issues.

  • Is it possible bypass basic file authentication in glassfish using default

    I have a glassfish application with basic authentication enabled and a single user setup in the file security realm wth a single group named 'internal'.
    My web.xml is setup with an auth-constraint limited to 'internal' role, my glassfish-web.xml maps the group 'internal' to the role 'internal'
    I have one cluster with an app ('api') running that is already accessed internally without the need for authentication.
    I am trying to set up a standalone instance with a seperate config (publicapi) that runs the same app but can only access functionality of the publicapi rather than the api
    My approach has been to add basic authentication to api with a default principal (internal) in its config. The principal is mapped to a user (internal) in the file security realm that has a single group in its list of 'internal'. My understanding was this would be able to bypass the basic authentication when using this config but it has not.
    This is my config within the api project: glassfish-web.xml
    <glassfish-web-app error-url="">
    <class-loader delegate="true"/>
    <jsp-config>
    <property name="keepgenerated" value="true">
    <description>Keep a copy of the generated servlet class' java code.</description>
    </property>
    </jsp-config>
    <security-role-mapping>
    <role-name>internal</role-name>
    <group-name>internal</group-name>
    <principal-name>internal</principal-name>
    </security-role-mapping>
    </glassfish-web-app>
    web.xml
    <?xml version="1.0" encoding="UTF-8"?>
    <web-app version="3.0" xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd">
    <security-constraint>
    <display-name>Limit non-internal principals</display-name>
    <web-resource-collection>
    <web-resource-name>Secure Application</web-resource-name>
    <url-pattern>/*</url-pattern>
    </web-resource-collection>
    <auth-constraint>
    <role-name>internal</role-name>
    </auth-constraint>
    </security-constraint>
    <login-config>
    <auth-method>BASIC</auth-method>
    <realm-name>Secure Area</realm-name>
    </login-config>
    <security-role>
    <description>Only accssible to internal roles</description>
    <role-name>internal</role-name>
    </security-role>
    </web-app>
    and sun-web.xml
    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE sun-web-app PUBLIC "-//Sun Microsystems, Inc.//DTD Application Server 9.0 Servlet 2.5//EN" "http://www.sun.com/software/appserver/dtds/sun-web-app_2_5-0.dtd">
    <sun-web-app error-url="">
    <security-role-mapping>
    <role-name>internal</role-name>
    <group-name>internal</group-name>
    <principal-name>internal</principal-name>
    </security-role-mapping>
    </sun-web-app>
    So is my understanding of being able to bypass the basic authentication using glssfish default principal flawed? Do default principals match to a user / group list that is added in the Glassfish control panel and therefore assocated with the same roles / groups? Any other info on how to correctly map the default principal to a security group and bypass authentication would be very useful. Thank you

    Haii
    your jsps or struts will not do that kind of client side jobs..u write a java script and do that.......
    regards
    Shanu

  • ACS 4.2.1 - PEAP Machine Authentication - Hostname different from PC account name in AD

    Hello!
    I don't really know, whether this issue has been asked before.
    I have to configure PEAP Authentication with ACS 4.2.1 for Windows against Active Directory.
    ACS ist Member of AD Domain xyz.domainname. The PC account is located in an OU of xyz.domainname.
    Hosts get via DHCP a hostname as dhcp.domainname. This also is the name the machine uses for AAA request.
    User authentication works fine, because the user account also is hosted in xyz.domainname.
    The host authentication fails, because dhcp.domainname is a DNS domain only but no Windows AD subdomain.
    Does anybody knows a solution for this special constellation?
    Is it possible to strip or rewrite the domain suffix in any way during the authentication process?

    /* Style Definitions */
    table.MsoNormalTable
    {mso-style-name:"Table Normal";
    mso-tstyle-rowband-size:0;
    mso-tstyle-colband-size:0;
    mso-style-noshow:yes;
    mso-style-priority:99;
    mso-style-qformat:yes;
    mso-style-parent:"";
    mso-padding-alt:0in 5.4pt 0in 5.4pt;
    mso-para-margin:0in;
    mso-para-margin-bottom:.0001pt;
    mso-pagination:widow-orphan;
    font-size:11.0pt;
    font-family:"Calibri","sans-serif";
    mso-ascii-font-family:Calibri;
    mso-ascii-theme-font:minor-latin;
    mso-fareast-font-family:"Times New Roman";
    mso-fareast-theme-font:minor-fareast;
    mso-hansi-font-family:Calibri;
    mso-hansi-theme-font:minor-latin;
    mso-bidi-font-family:"Times New Roman";
    mso-bidi-theme-font:minor-bidi;}
    Hello Jean,
    I am guessing that you are using 802.1x wireless.
    This is a expected behaving because the AD force the computer to change his password every month and if the computer is not on the domain at that moment the computer won't take that change.
    This is a Microsoft issue and unfortunately Cisco does not have any workaround for that.
    Please see links below that explain this situation.
    http://support.microsoft.com/kb/216393/en-us
    http://support.microsoft.com/kb/904943
    Hope this helps
    Erdelgad
    Cisco CSE

  • Cisco ISE Failure: 24408 User authentication against Active Directory failed since user has entered the wrong password

    Hi,
    Since we implemented Cisco ISE we receive the following failure on several Notebooks:
    Authentication failed : 24408 User authentication against Active Directory failed since user has entered the wrong password
    This happens 2 or 3 times per Day. So basically the authentications are working. But when the failure appears, the connection is lost for a short time.
    The Clients are using PEAP(EAP-MSCHAPv2) for Authentication. We've got a Cisco Wireless Environment (WLC 5508).
    Why is this happening?
    Thanks,
    Marc

    The possible causes of this error message are:
    1.] If the end user entered an incorrect username.
    2.] The shared sceret between WLC and ISE is mismatched. With this we'll see continous failed authentication.
    3.] As long as a PSN not receiving a response from the supplicant within this limit during an EAP conversation, it will throw this error code. In majority of cases it says eap session timed out.
    In your cases, the 3rd option seems to be the most closest one.
    Jatin Katyal
    - Do rate helpful posts -

  • Machine Authentication and User Authentication with ACS v5.1... how?

    Hi!
    I'm having trouble setting up Machine Authentication and User Authentication on ACS v5.1 using WinXP SP3 (or SP2) as supplicant.
    This is the goal:
    On wireless (preferably on wired too) networks, get the WinXP to machine authenticate against AD using certificates so the machine is possible to reach via for example ping, and it can also get GPO Updates.
    Then, when the user actually logs in, I need User Authentication, so we can run startup scripts, map the Home Directory and so on.
    I have set up a Windows Sertificate server, and the client (WinXP) are recieving both machine and user certificates just fine.
    I have also managed to set up so Machine Authenticaton works, by setting up a policy rule that checks on certificate only:
    "Certificate Dictionary:Common Name contains .admin.testdomain.lan"
    But to achieve that, I had to set EAP Type in WinXP to Smart Card or other Certificate, and then no PEAP authentication occurs, which I assume I need for User Authentication? Or is that possible by using Certificates too?
    I just don't know how to do this, so is there a detailed guide out there for this? I would assume that this is something that all administrators using wireless and WinXP would like to achieve.
    Thank you.

    Hello again.
    I found out how to do this now..
    What I needed to do was to add a new Certificate Authentication Profile that checks against Subject Alternative Name, because that was the only thing I could find that was the same in both user certificate and machine certificate.
    After adding that profile to the Identity Store Sequences, and making tthe appropriate rule in the policy, it works.
    You must also remember to change the AuthMode option in Windows XP Registry to "1".
    What I really wanted to do was to use the "Was Machine Authenticated" condition in the policies, but I have never gotten that conditon to work, unfortunately.
    That would have plugged a few security holes for me.

  • ISE - Machine + user authentication

    I've searched forum, community but I couldn't find exactly what I need:
    I have a client that want's to use two step authentication on wireless: first machine authentication to make sure that device is on the domain and then username/password authentication.
    Now, I've read about MAR, EAP chaining, and I understood it all, only thing I didn't understand is:
    If I configure ISE to authenticate machine, it will allow limited access to DC (for example).
    Then, after that AuthZ profile is applied, what will do new authorization? My understanding is once MAR is done, AuthZ profileis applied and authorization is finished.
    Now, I am not asking about turning on laptop, getting PC on the network, then logging in and then providing the user/credentials, etc. I am asking for this scenario:
    How ISE policy and AuthZ profile should look like, for example, I come in the office, my wireless card is disabled, I login to my laptop, then I notice that my wireless card is disabled and now I enable it. I need to have Machine authentciation happening at that point + prompting user for username/password to complete registration on wireless.
    NAM is already refused by client, so I need something that will work on plain Windows 7.
    Thanks.

    Hello Align-
    In your post you are referring to two completely separate and independent solutions:
    1. MAR
    2. EAP-Chaining
    MAR only happens when the machine first boots up and the host presents its machine domain credentials. Then the machine MAC address is saved in ISE. The MAC is preserved in ISE as long as configured in the machine timer. Keep in mind that if let's say a computer was booted while connected on the wired network, only that MAC address will be authenticated. If the user moves to wireless, the connection will be denied as ISE will not have any records of the wireless MAC. Along with all of that, you will need another method (usually PEAP) to perform the user authentication. Usually this method is not a very good one to implement due to the issues listed
    EAP-Chaining on the other hand utilizes EAP-FAST and it s a multi-phase method during which both machine and user information is passed in a secured TLS tunnel. For that you need to implement Cisco AnyConnect as it is the only software supplicant that supports it at the moment. For more info you might wanna look into Cisco's TrustSec guide:
    http://www.cisco.com/en/US/solutions/collateral/ns340/ns414/ns742/ns744/docs/howto_80_eapchaining_deployment.pdf
    I hope this helps!
    Thank you for rating!

  • 802.1x PEAP Machine Authentication with MS Active Directory

    802.1x PEAP Machine and User Authentication with MS Active Directory:
    I have a simple pilot-text environment, with
    - Microsoft XP Client,
    - Cisco 2960 Switch,
    - ACS Solution Engine (4.1.4)
    - MS Active Directory on Win 2003 Server
    The Remote Agent (at 4.1.4) is on the same server as the MS AD.
    User Authentication works correctly, but Machine Authentication fails.
    Failed machine authenticaton is reported in the "Failed Attempts" log of the ACS SE.
    The Remote Agent shows an error:
    See Attachment.
    Without Port-Security the XP workstation is able to log on to the domain.
    Many thanks for any indication.
    Regards,
    Stephan Imhof

    Is host/TestClientMan.Test.local the name of the machine? What does the AAA tell for you the reason it fails?

  • 802.1X wirelss restriction on user authentication

    Hi,
    In the 802.1x wireless environment, I would like to know is there any method to control single user credential only able to be autheticated for one time, at any given time.
    Example: user ABC in domain XYZ.ORG authenticated via his/her desktop, this is using user authentication method.
    After this he/she not able to use the same username/password trying to get authenticate neither using any another PC/tablet/smartphone devices.
    The motive is to prevent user using same user credential able sign-in after he/she made the authenticaiton at first place.
    Meaning to say he/she only able to authenticate to single device, at any given time. Same user credential is not allow to be use for authenticate purpose on other device.
    The components as below:
    supplicant: Window 7, authentication method using PEAP/MSCHAPv2; Apple iPhone iOS version 5.x, 6.x
    Authenticator: Cisco Wireless Controller 5800 Series on code version 7.2
    Authentication server: Cisco secure server ACS 5.3
    Identity Source : Microsoft server 2008 ADDS, single forest single domain.
    Question:
    01. What we can configure on WLC, or ACS to enable above mention requirement
    Thanks
    Noel

    http://www.cisco.com/c/en/us/support/docs/wireless/5500-series-wireless-controllers/112175-acs51-peap-deployment-00.html

  • 802.1x machine vs user authentication

    In the process of depolying 802.1x on wired LAN. What is the difference between machine authentication and user authentication? Thanks in advance.

    OK, so assuming we're still talking the MSFT supplicant, you have some options:
    1) USe EAP-TLS and mark any certs deployed to your corporate-owned assets and non-exportable. This solves the issue by brute force. You don't exactly need machine-authentication to do this. You may need machine-auth for other reasons (as I believe we've discussed here).
    2) If PEAP is in use, use the machine-auth and the Machine-Access-Restriction feature in ACS. What this does is a coupling of the notions of machine-auth as a preceeding policy decision for user-auth. Example: It is technically possible that anyone with a valid NT account may be able to 802.1x-authenticate from "any" machine. But with the machine-access-restriction feature, they will only be able to do so if ACS has also authenticated a valid machine-auth session prior to the login attempt.
    3) Use a NAR in ACS. A NAR is a Network Access Restriction. If for example, you have a database of all the MAC Addresses you have (or an OID wildcard) you can configure further checking of a MAC address from an otherwise valid 802.1x authentication attempt. This effectively tells ACS to only allow authentication attempts from MAC Addresses it knows about.
    Hope this helps.

  • PEAP : Machine authentication doesn't work

    Hello,
    I'm trying to set up machine authentication and at this time I have some problems.
    I have the following configuration:
    - the users laptop are running WinXP
    - the AP is a 1232
    - ACS 3.3.2
    - external database (Win2000 Active Directory) authentication
    I set up PEAP and it works well when a user is authenticated. However when I enable machine authentication on the ACS and also on the user laptop, it doesn't work. In the ACS logs I can see that the user has not authenticated due to the machine access restriction.
    On the Active Directory I changed the Dial In config. for the computers to allow access.
    Is there anything else that has to be modified in order to perform machine authentication?
    Hope someone will be able to help me.
    Thanks in advance.
    Alex

    Hi Alex
    I have had a similar issue, I found that my PEAP users were fine but Machine authentication failed at the SSL handshake. I.E the machine didn't know where the local certificate was. In the meantime to get the policies working I unchecked the "validate server certificate" on the client. And that works, I would assume that the certificate needs to be in a specific default location for the machine authentication to use it, though thats just a guess.
    I am spending the day to get this working and I'll post what I find out.
    Regards
    Colin

  • Bypass ISA Proxy authentication

    Hi 
    My environment: External users access SharePoint intranet site by entering credentials in Microsoft ISA server login page(authenticate to ISA server then accessing all sharepoint sites).
    one client wants to access sharepoint intranet without ISA authentication.Is there any way to access SharePoint intranet site(https://domainname/sites/site1) from internet without ISA authentication.I mean bypass ISA proxy authentication for this particular
    SharePoint site(https://domainname/sites/site1)
    SharePoint site(https://domainname/site/site1) is enabled with anonymous authentication.
    Thanks for any help.

    Your client can edit his hostfile.
    C:\Windows\System32\drivers\etc\hosts
    Here you specify the IP-Adress of your particular SP server and your URL.

Maybe you are looking for