Certificate based wireless connection
Hi
I work for a Government as a Technician and we are in a Novell environment. We have a Wireless network which is setup using Wifi Certificates on the Laptops. It has been working fine with this setup until windows 8 came out. Then some things didn't work
properly but it could still connect.
Now I have windows 8.1 laptops that we just procured and the wireless certificate setup doesn't work at all. I can install the certificates and configure the wireless connection but it just doesn't connect. I notice that when I install the certificate I
had 2 options, Local User and Local Computer. I played around with different options but it didn't work.
Is there any specific way I need to setup the certificate based connection or has anyone been able to connect using certificates? We are in the process of upgrading our systems and this will be a big problem if it doesn't work.
Thanking you in advance.
Mthuthu (South Africa)
PS: We have the same problem with the windows 8 phones.
Hi,
Firstly, please try to use network troubleshooter to diagnose this problem.
Control Panel\All Control Panel Items\Troubleshooting
Secondly, if this problem actually caused by Certificates problem, please refer to the link below to install Certificate for test.
http://blogs.technet.com/b/sbs/archive/2007/04/10/installing-a-self-signed-certificate-as-a-trusted-root-ca-in-windows-vista.aspx
Roger Lu
TechNet Community Support
Similar Messages
-
Make certificate-based wireless unavailable at login?
Error: "Unable to log in with a network account" appears because the wireless connection goes offline. WEP networks work okay, but our internal network uses wireless with EAP certificate-based authentication. Since the Macbook does not come with ethernet jack, I have no other option. How do I get it to connect to the wireless prior to login?
does this article help.
http://support.apple.com/kb/ht4772 -
How can I ignore server certificate for wireless connection?
I just got a Treo 800w and can't get it connected to my work wireless. It uses PEAP MS-CHAPV2. How can I get the device to ignore the server certificate?
Thanks,
Adam
Post relates to: Treo 800w (Sprint)You can't. You would need to have your IT to setup the wireless with the certificate on the device.
Post relates to: Palm Z22 -
AX resets wireless connection to "require a certificate"
I've established connection but, apparently, the Airport Utility resets my wireless network to require a certificate and can't "validate identity" something my Linksys wireless is not set up to do. Is there a Utility setting that does not require or force the certificate? The connection goes on and off, much more off than on apparently looking for the certificate
kilometro, Welcome to the discussion area!
There is nothing on Apple's base stations that cause such a prompt. What is the AirPort Express (AX) connected to? -
Hi, I am using IPad and trying to connect to corporate Wireless network. The Corporate Radius server is configured for Certificate based authentication. I have installed user cert in IPad but when trying to connect it is saying wrong credentials. I hv checked the logs of RADIUS server and it is saying that wrong authentication method used.
The same user cert is working in Laptops. The IPad is not added to any domain. I need to configure PEAP with Certificate authentication in IPad.
Please suggestupdating the firmware for better compatibility is adviced
-
Certificate based authentication for Exchange ActiveSync in Windows 8.* Mail app
I have a Surface Pro and want to setup access to my company's Exchange server that accepts only Exchange ActiveSync certificate-based authentication.
I've installed server certificates to trusted pool and my certificate as personal.
Then I can connect thru Internet Explorer, but this is not comfortable to use.
I don't have a password because of security politics of our company. When I'm setting up this account on my Android phone I'm using any digit for password and it works perfectly.
Can someone help to setup Windows 8 metro-style Mail application? Does it supports this type of auth? When I'm trying to add account with type Outlook, entering server name, domain name, username, 1 as a password then I've got a message like "Can't
connect. Check your settings."
Is there any plans to implement this feature?For what it's worth we have CBA working with Windows 8.1 Pro. In our case we have a MobileIron Sentry server acting as an ActiveSync reverse-proxy, so it verifies the client cert then uses Kerberos Constrained Delegation back to the Exchange CAS, however
it should work exactly the same to the Exchange server directly. I just used the CA to issue a User Certificate, exported the cert, private key and root CA cert, copied to the WinPro8.1 device and into the Personal Store. Configured the Mail app
to point at the ActiveSync gateway, Mail asked if I would like to allow it access the certificate (it chose it automatically) and mail synced down immediately...
So it definitely works with Windows Pro 8.1. -
Unable to access wireless connection with linksys rooter WRT54GS
Hi,
I just installed a wireless rooter Linksys WRT54GS on my connection, The problem I have is being able to access it with my wireless on my laptop.
I kept getting a message stating "connection unindentified" "access limited". I've done most of what is already suggested on your forum such has turning the power off of my rooter, my modem and such and still nothing. I'm able to access the wireless with my girlfriend Mac Notebook, my playstation 3 and my desktop computer which uses Windows X. First I thought that it my be a problem with my security but even when the connection is unprotected I still get that error. I try to disable the IpV6but that didn'tdo anything either.
My laptop is a Toshiba Qosmio X300 PQX32C-033019 with Vista and my rooter is a Linksys WRT54GS vers. 6
Here's my connection log, sorry if it's in French:
Informations sur l'ordinateur
Vendor:TOSHIBA
Machine Name:Qosmio X300
VersionQX32C-033019
CPU Maker:GenuineIntel
CPU Name:Intel(R) Core(TM)2 Duo CPU P8400 @ 2.26GHz
CPU Clock:2267
CPU Base Clock:2267
OS:Microsoft® Windows Vista™ Édition Familiale Premium
OS Build:6001
OS SPervice Pack 1
Ram:4188120
Début de la page
Informations IP
ipconfig /all
Configuration IP de Windows
Nom de l'h“te . . . . . . . . . . : PC-de-ThomasMur
Suffixe DNS principal . . . . . . :
Type de noeud. . . . . . . . . . : Mixte
Routage IP activ‚ . . . . . . . . : Non
Proxy WINS activ‚ . . . . . . . . : Non
Liste de recherche du suffixe DNS.: phub.net.cable.rogers.com
Carte r‚seau sans fil Connexion r‚seau sans filÿ:
Suffixe DNS propre … la connexion. . . :
Description. . . . . . . . . . . . . . : Intel(R) Wireless WiFi Link 5100
Adresse physique . . . . . . . . . . . : 00-21-5D-3D-9C-08
DHCP activ‚. . . . . . . . . . . . . . : Oui
Configuration automatique activ‚e. . . : Oui
Adresse IPv6 de liaison locale. . : fe80::a9d9:4618:2ae4:d7e5%11(pr‚f‚r‚)
Adresse d'autoconfiguration IPv4 . . . : 169.254.215.229(pr‚f‚r‚)
Masque de sous-r‚seau. . . .ÿ. . . . . : 255.255.0.0
Passerelle par d‚faut. . . .ÿ. . . . . :
Serveurs DNS. . . . . . . . . . . . . : fec0:0:0:ffff::1%1
fec0:0:0:ffff::2%1
fec0:0:0:ffff::3%1
NetBIOS sur Tcpip. . . . . . . . . . . : Activ‚
Carte Ethernet Connexion au r‚seau local :
Suffixe DNS propre … la connexion. . . : phub.net.cable.rogers.com
Description. . . . . . . . . . . . . . : Realtek RTL8168C/8111C Family PCI-E Gigabit Ethernet NIC (NDIS 6.0)
Adresse physique . . . . . . . . . . . : 00-1E-EC-3F-7B-CF
DHCP activ‚. . . . . . . . . . . . . . : Oui
Configuration automatique activ‚e. . . : Oui
Adresse IPv6 de liaison locale. . : fe80::4da:b21b:843c:7bfd%10(pr‚f‚r‚)
Adresse IPv4. . . . . . . . . . . : 192.168.1.100(pr‚f‚r‚)
Masque de sous-r‚seau. . . .ÿ. . . . . : 255.255.255.0
Bail obtenu. . . . . . . . .ÿ. . . . . : 8 juin 2009 18:11:58
Bail expirant. . . . . . . . .ÿ. . . . : 9 juin 2009 18:11:58
Passerelle par d‚faut. . . .ÿ. . . . . : 192.168.1.1
Serveur DHCP . . . . . . . . . . . . . : 192.168.1.1
Serveurs DNS. . . . . . . . . . . . . : 64.71.255.198
NetBIOS sur Tcpip. . . . . . . . . . . : Activ‚
Carte Tunnel Connexion au r‚seau local* :
Statut du m‚dia. . . . . . . . . . . . : M‚dia d‚connect‚
Suffixe DNS propre … la connexion. . . : phub.net.cable.rogers.com
Description. . . . . . . . . . . . . . : isatap.phub.net.cable.rogers.com
Adresse physique . . . . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP activ‚. . . . . . . . . . . . . . : Non
Configuration automatique activ‚e. . . : Oui
Carte Tunnel Connexion au r‚seau local* 6 :
Statut du m‚dia. . . . . . . . . . . . : M‚dia d‚connect‚
Suffixe DNS propre … la connexion. . . :
Description. . . . . . . . . . . . . . : Carte Microsoft ISATAP #2
Adresse physique . . . . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP activ‚. . . . . . . . . . . . . . : Non
Configuration automatique activ‚e. . . : Oui
Début de la page Informations de routage
route print
===========================================================================
Liste d'Interfaces
11 ...00 21 5d 3d 9c 08 ...... Intel(R) Wireless WiFi Link 5100
10 ...00 1e ec 3f 7b cf ...... Realtek RTL8168C/8111C Family PCI-E Gigabit Ethernet NIC (NDIS 6.0)
1 ........................... Software Loopback Interface 1
13 ...00 00 00 00 00 00 00 e0 isatap.phub.net.cable.rogers.com
12 ...00 00 00 00 00 00 00 e0 Carte Microsoft ISATAP #2
===========================================================================
IPv4 Table de routage
===========================================================================
Itin‚raires actifsÿ:
Destination r‚seau Masque r‚seau Adr. passerelle Adr. interface M‚trique
0.0.0.0 0.0.0.0 192.168.1.1 192.168.1.100 20
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
169.254.0.0 255.255.0.0 On-link 169.254.215.229 281
169.254.215.229 255.255.255.255 On-link 169.254.215.229 281
169.254.255.255 255.255.255.255 On-link 169.254.215.229 281
192.168.1.0 255.255.255.0 On-link 192.168.1.100 276
192.168.1.100 255.255.255.255 On-link 192.168.1.100 276
192.168.1.255 255.255.255.255 On-link 192.168.1.100 276
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 192.168.1.100 276
224.0.0.0 240.0.0.0 On-link 169.254.215.229 281
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 192.168.1.100 276
255.255.255.255 255.255.255.255 On-link 169.254.215.229 281
===========================================================================
Itin‚raires persistantsÿ:
Aucun
IPv6 Table de routage
===========================================================================
Itin‚raires actifsÿ:
If Metric Network Destination Gateway
1 306 ::1/128 On-link
10 276 fe80::/64 On-link
11 281 fe80::/64 On-link
10 276 fe80::4da:b21b:843c:7bfd/128
On-link
11 281 fe80::a9d9:4618:2ae4:d7e5/128
On-link
1 306 ff00::/8 On-link
10 276 ff00::/8 On-link
11 281 ff00::/8 On-link
===========================================================================
Itin‚raires persistantsÿ:
Aucun
Début de la page Informations de protocole
Protocol Bind Information
SSTP based VPN
Microsoft TCP/IP version 6 - Tunnels
isatap.{DF6498ED-F5F7-4E96-9496-10C8BB95FA20}
isatap.phub.net.cable.rogers.com
Internet Protocol (TCP/IP) - Tunnels
Microsoft NetbiosSmb
Internet Protocol Version 4 (TCP/IPv4)
Intel(R) Wireless WiFi Link 5100
Internet Protocol Version 4 (TCP/IPv4)
Realtek RTL8168C/8111C Family PCI-E Gigabit Ethernet NIC (NDIS 6.0)
Internet Protocol Version 6 (TCP/IPv6)
isatap.{DF6498ED-F5F7-4E96-9496-10C8BB95FA20}
Internet Protocol Version 6 (TCP/IPv6)
isatap.phub.net.cable.rogers.com
Internet Protocol Version 6 (TCP/IPv6)
Intel(R) Wireless WiFi Link 5100
Internet Protocol Version 6 (TCP/IPv6)
Realtek RTL8168C/8111C Family PCI-E Gigabit Ethernet NIC (NDIS 6.0)
Remote Access IP ARP Driver
Miniport WAN (IP)
Message-oriented TCP/IP Protocol (SMB session)
WINS Client(TCP/IP) Protocol
Internet Protocol Version 4 (TCP/IPv4)
Intel(R) Wireless WiFi Link 5100
Internet Protocol Version 4 (TCP/IPv4)
Realtek RTL8168C/8111C Family PCI-E Gigabit Ethernet NIC (NDIS 6.0)
Internet Protocol Version 6 (TCP/IPv6)
isatap.{DF6498ED-F5F7-4E96-9496-10C8BB95FA20}
Internet Protocol Version 6 (TCP/IPv6)
isatap.phub.net.cable.rogers.com
Internet Protocol Version 6 (TCP/IPv6)
Intel(R) Wireless WiFi Link 5100
Internet Protocol Version 6 (TCP/IPv6)
Realtek RTL8168C/8111C Family PCI-E Gigabit Ethernet NIC (NDIS 6.0)
Internet Protocol Version 6 (TCP/IPv6)
isatap.{DF6498ED-F5F7-4E96-9496-10C8BB95FA20}
isatap.phub.net.cable.rogers.com
Intel(R) Wireless WiFi Link 5100
Realtek RTL8168C/8111C Family PCI-E Gigabit Ethernet NIC (NDIS 6.0)
Internet Protocol Version 4 (TCP/IPv4)
Intel(R) Wireless WiFi Link 5100
Realtek RTL8168C/8111C Family PCI-E Gigabit Ethernet NIC (NDIS 6.0)
Remote Access IPv6 ARP Driver
Miniport réseau étendu WAN (IPv6)
Point to Point Protocol Over Ethernet
Intel(R) Wireless WiFi Link 5100
Realtek RTL8168C/8111C Family PCI-E Gigabit Ethernet NIC (NDIS 6.0)
Point to Point Tunneling Protocol
Layer 2 Tunneling Protocol
Remote Access NDIS WAN Driver
WAN Miniport (SSTP)
Carte asynchrone RAS
Miniport WAN (PPPOE)
Miniport réseau étendu WAN (PPTP)
Miniport réseau étendu WAN (L2TP)
Link-Layer Topology Discovery Mapper I/O Driver
Intel(R) Wireless WiFi Link 5100
Realtek RTL8168C/8111C Family PCI-E Gigabit Ethernet NIC (NDIS 6.0)
Link-Layer Topology Discovery Responder
Intel(R) Wireless WiFi Link 5100
Realtek RTL8168C/8111C Family PCI-E Gigabit Ethernet NIC (NDIS 6.0)
NDIS Usermode I/O Protocol
Intel(R) Wireless WiFi Link 5100
Realtek RTL8168C/8111C Family PCI-E Gigabit Ethernet NIC (NDIS 6.0)
Début de la page Informations sur les équipements
Realtek RTL8168C/8111C Family PCI-E Gigabit Ethernet NIC (NDIS 6.0)
Device ID : PCI\VEN_10EC&DEV_8168&SUBSYS_FF001179&REV_02\4&492937F&0&00E2
Status : Enable
Driver Vender : Realtek
Driver Version : 6.205.403.2008
Driver Date : 4-3-2008
Intel(R) Wireless WiFi Link 5100
Device ID : PCI\VEN_8086&DEV_4232&SUBSYS_12018086&REV_00\4&3905AE0C&0&00E3
Status : Enable
Driver Vender : Intel
Driver Version : 12.0.0.73
Driver Date : 4-27-2008
Bluetooth
Device ID : ACPI\TOS6205\5&F592293&0
Status : Disable
Bluetooth Version : v6.10.07.2(T)
Début de la page Statut du commutateur de communications sans fil et de la touche d'accès direct pour réseau sans fil
Wireless Communication Switch : On
Wireless Hotkey (Fn + F8)
Wireless LAN : On
Solved!
Go to Solution.Try this -
Open an Internet Explorer browser page on your wired computer(desktop).In the address bar type - 192.168.1.1 and press Enter...
Leave username blank & in password use admin in lower case...
For Wireless Settings, please do the following : -
Click on the Wireless tab
- Here select manual configuration...Wireless Network mode should be mixed...
- Provide a unique name in the Wireless Network Name (SSID) box in order to differentiate your network from your neighbours network...
- Set the Radio Band to Standard-20MHz and change the Standard channel to 11-2.462GHz...Wireless SSID broadcast should be Enabled and then click on Save Settings...
Please make a note of Wireless Network Name (SSID) as this is the Network Identifier...
For Wireless Security : -
Click on the Sub tab under Wireless > Wireless Security...
Change the Wireless security mode to WEP, Encryption should be 64 bit.Leave the passphrase blank, don't type in anything...
Under WEP Key 1 type in any 10 numbers please(numbers only and no letters eg: your 10 digit phone number) and click on save settings...
Please make a note of WEP Key 1 as this is the Security Key for the Wireless Network...
Click on Advanced Wireless Settings
Change the Beacon Interval to 75 >>Change the Fragmentation Threshold to 2304, Change the RTS Threshold to 2304 >>Click on "Save Settings"...
On your Vista Laptop, first disable the Wireless Network Connection and restart the Laptop, then Enable the Wireless Connection...
Then Click on Start >> Control Panel >> Network and Sharing Center >> Manage Wireless Network and click on Add, select Manually Create a Network Profile and click Next, enter your Network SSID/Network Name, select WEP for Security type and enter your 10 digit Network Key and click on Next, it should say "Successfully Connected to ____" close all the Windows and restart the Laptop, now see if you can connect to Internet Wirelessly... -
Urgent! T420 with N6205 keeps dropping wireless connection and cannot recover
Hello everyone,
I bought my T420 model with N6205 network card last December, since then, the wireless connection never functions well. Here's the problem(it happens in my apartment):
Every once in a while (normally within four to five days), my wireless connection drops automatically. It would first appear as no connection and it'll try to reconnect, then it appears as successful connected for 5 to 10 seconds(but definitely no internet access), and it'll drop the connection completely again, then automatically repeat :reconnect, drop,reconnect, drop ... never stops. Though I can still use cable to connect to my router to have internet access.
This problem occurs to none of my smartphones, ipad, ipod touch, my old laptop and my roomates' wireless devices under the same wirless environment. They always have solid wireless connection.
Of course, regular approaches have been taken trying to solve the problem:
1. manually disable wireless functionality on my T420, and enable it again
failed
2. reboot computer
failed
3. go to power manager and turn PCI express off
failed
4. uncheck allow the wireless LAN radio to be turned off when inactive
failed
5.updated to the latest driver through lenovo
failed
6. restart router
successful
So it may be that I've got a bad router? This is why I didn't post my problem in the first place, since I was hoping it may disappear with other routers.
I changed to a new router, the problem persists.
There's no way I can restart the router every time when my laptop looses connection, it'll affect the other users.
Based on the description of my problem, I believe there's a great chance there's something wrong with my T420 rather than with my router.
Is there anybody who can help me with this?
Can lenovo staff see this post?
Any suggestion about who I should turn to?
Thanks a lot.
T420,
i7 2640M, N6205
Windows 7 professional, 64 bitWhat security mode are you using.
WPA or WPA2? You could change the router to WPA only and see if that helps. I have see some portable devices that don't negotiate the protcol properly but never a notebook. If you have Bluetooth turn it off. It seems to affect my 1x1.
I have the 1x1 card and it pretty bad connecting at 24 to 48 Mbps only with a good signal. I don't know why Realtek is used in a Business class notebook. Maybe some others can add what they have and is working 100%.
T520 Model 4239 Intel(R) Core(TM) i7-2860QM CPU @ 2.50GHz
Intel Sandy Bridge & Nvidia NVS 4200M graphics Intel N 6300 Wi-Fi adapter
Windows 7 Home Prem - 64bit w/8GB DDR3 -
Multiple Wireless Connections?
We recently moved into a friend's house (temporarily, thank goodness!) and they already have a Windows-based wireless network in place. Their wireless router is some sort of Cisco/LinkSys device. Our two iMacs and my MacBook Air connect to the Internet via their network just fine.
Prior to moving in with them, I had my own wireless network in our home, using an Airport Extreme with a USB-2 connected 1TB hard drive for Time Machine. I was able to back up all three of our Macs to that hard drive, plus get to the Internet, and life was good.
I can connect to their network for Internet access, but not to my Airport Extreme at the same time. When I tell one of my Macs to connect to my Airport Extreme, it tosses out the other network, making it impossible to stay connected to the Internet while doing Time Machine backups. When I then tell the Mac to connect to our friend's network for Internet access, it tosses out my Airport Extreme connection, making the scheduled Time Machine backups fail.
Is there any way to have OS X connect to two wireless networks at the same time?Hi Martin - thanks for the quick reply!
I had a feeling that the answer was gonna be "no", but thought I'd ask anyway. Additional wireless cards/adapters in the iMac can't happen so I'll have to go the other route.
Their LinkSys unit has several Ethernet ports on the back and I probably could connect the Airport Extreme to it. I had been using a LinkSys DSL modem and getting my IP address via DHCP from it, so it "should" be fairly transparent to the Airport Extreme. Where I'll run into issues with this connection scheme is with electrical power. I took a look at their setup and they have three 117VAC plug strips hooked together, into a wall outlet - ughhhh!!!
Guess I'll have to weigh the benefits of routine backups against having yet another pair of devices hooked into their rat's nest of cables & plug strips.
Thanks for the info - wish me luck! -
Has anybody solved the slow wireless connections speeds of the new Imacs
I have just purchased the new imac...and was made aware of the disastrous connections speeds using wireless.. Does anybody know if apple have come up with a solution...or are they just not dealing with the problem?
I am a brand new Mac user with a new 24 inch iMac purchase. Macs are supposed to be hassle free right? Right. No question I was about ready to throw it out the window because the wireless connection to the expensive AP base station was, oh, 100x slower than my Dell laptop side by side about 1 foot away. Nothing changed even if I connected directly to the AP using an ethernet cable. My connection consists of an Actiontec DSL gateway connected directly to my AP extreme that allows wireless to my PC laptop as well as my new iMac. Hours and hours go by until I find this help link on Mac Orchard Forums:
+" Re: My New Intel Based iMac is SLOW+
+« Reply #7 on: May 18th, 2007, 4:57am » Quote Quote Modify Modify+
+WOW!! everyone else with this problem read this! i was having these same huge speed problems using the internet with my new 24" dual core intel imac with 2 gigs of ram and found a posting on another site's thread that fixed it completely.+
+"Try setting your DNS servers to OpenDNS (208.67.222.222 and 208.67.220.220) and see if that helps at all. Maybe the ISP's changes increased the load on their DNS servers."+
+my guess is that somehow these DNS servers work the way tiger likes them to while others dont, i have no clue other than to say it works!!+
+heres a site i found that helped me understand how to change the settings:+
+http://portforward.com/networking/static-Mac10.4.htm "+
With the new Leopard installed I went to the "portforward" link first and followed the instructions exactly to set a static IP address, then I reset my DNS servers with the exact numbers you see above - IT WORKED IMMEDIATELY!!!!! I didn't have to call my ISP or anything, it just worked exactly as it should with both Safari and Firefox. Now this Mac is flying and I will not be tossing it back to Jobs.
Good Luck! -
Certificate based authentication
I have a client application that requires certificate based authentication.
I could not find any instructions on how to set this up in the 11g manuals. So I reverted to the 5.2 manual (http://docs.oracle.com/cd/E19850-01/816-6698-10/ssl.html#18500), and followed some instructions found online.
I have completed the setup, and the client is able to authenticate using his certificate, and I have verified this in the logs.
[22/Mar/2012:13:13:33 -0500] conn=34347 op=-1 msgId=-1 - SSL 128-bit RC4; client CN=userid,OU=company,L=city,ST=state,C=US; issuer CN=issuing,DC=corp,DC=company,DC=lan
[22/Mar/2012:13:13:33 -0500] conn=34347 op=-1 msgId=-1 - SSL client bound as uid=userid,ou=employees,o=company
[22/Mar/2012:13:13:33 -0500] conn=34347 op=0 msgId=1 - BIND dn="" method=sasl version=3 mech=EXTERNAL
When adding the usercertificate attribute to the ID I used the following LDIF:
version: 1
dn: uid=userid,ou=employees,o=company
changetype: modify
replace: userCertificate
usercertificate: < file:///home/user/Certs/usercert.bin
the file was a binary encoded certificate file.
Here is the part that I don't understand when I do a search (or LDIF export) of the user object with the certificate it just returns a short base64 encoded string. when I decode this string, it is just the literal string of "< file:///home/user/Certs/usercert.bin".
So it appears that the certificate has not been stored on the user object in binary, and yet the certificate authentication still works. The file mentioned, does not exist on the LDAP server (the cert was loaded from another server), so there is no way that it is reading the cert from the file.
Anyone have any idea what is going on here? And why certificate auth works, when there appears to be not cert stored in LDAP?
If by chance this is how it is all suppose to work, then how do I go about backing up the usercertificate attribute when I do my LDAP data backups?
Thanks
BrianCyril,
Thanks for the reply.
I believe I am doing both types of certificate authentication, you are describing. My issue is that when I perform the steps to store the PEM formatted cert into the directory server, rather than storing a binary value of the cert, it appears to be storing the path to the file I attempted to import. The odd part is that I can still authenticate even after this is done.
I tried to post as much info as I could before without posting any sensitive data, I'll try and expand on that below.
Here is my documentation of the steps taken to configure the server and setup a user, for what I believe to be certificate based authentication, where the user is authenticated solely on the certificate that they provide (no password is sent).
1. Server must be running SSL, all connections for Certificate Auth are done over SSL (just a note)
2. From the DSCC
----a. Directory Servers Tab -> Servers Tab -> Click Server Name
----b. Security Tab -> General Tab
----c. In "Client Authentication" section, select:
--------i. LDAP Settings: "Allow Certificate-Based Client Authentication"
--------ii. This should be the default setting.
3. On the directory server setup the /ldap/dsInst/alias/certmap.conf file:
----a. certmap default default
----default:DNComps
----default:FilterComps uid,cn
4. restart the directory server
5. Do the following to setup the user who will be connecting. On their unix account (or similar)
----a. Create a directory to hold the certDB
--------i. mkdir certdb
----b. Create a CertDB
--------i. /ldap/dsee7/bin/certutil -N -d certdb
------------1) Enter a password when prompted
----c. Import the CA cert
--------i. /ldap/dsee7/bin/certutil -A -n "OurRootCA" -t "C,," -a -I ~/OurRootCA.cer -d certdb
----d. Create a cert request
--------i. /ldap/dsee7/bin/certutil -R -s "cn=userid,ou=company,l=city,st=state,c=US" -a -g 2048 -d certdb
----e. Send the cert request to the PKI Team to generate a user cert
----f. Take the text of the generated cert & save it to a file
----g. Import the new cert into your certdb
--------i. /ldap/dsee7/bin/certutil -A -n "certname" -t "u,," -a -i certfile.cer -d certdb
----h. Create a binary version of cert
--------i. /ldap/dsee7/bin/certutil -L -n "certname" -d certdb -r > userid.bin
----i. Add the binary cert to the user's LDAP entry (version: 1 must be included - I read this in a doc somewhere, but it doesn't seem to matter)
--------i. ldapmodify
------------1) ldapmodify -h host -D "cn=directory manager" -w password -ac
------------2)
------------version: 1
------------dn: uid=userid,ou=employees,o=company
------------sn: Service Account
------------givenName: userid
------------uid: userid
------------description: Service Account for LDAP
------------objectClass: top
------------objectClass: person
------------objectClass: organizationalPerson
------------objectClass: inetorgperson
------------cn: Service Account
------------userpassword: password
------------usercertificate: < file:///home/userid/Certs/userid.bin
------------nsLookThroughLimit: -1
------------nsSizeLimit: -1
------------nsTimeLimit: 180
After doing this setup I am able to perform a search using the certificate:
ldapsearch -h host -p 1636 -b "o=company" -N "certname" -Z -W CERTDBPASSWORD -P certdb/cert8.db "(uid=anotherID)"
This search is successful, and I can see it logged, as having been a certificate based authentication:
[23/Mar/2012:13:25:20 -0500] conn=44605 op=-1 msgId=-1 - fd=136 slot=136 LDAPS connection from x.x.x.x:53574 to x.x.x.x
[23/Mar/2012:13:25:20 -0500] conn=44605 op=-1 msgId=-1 - SSL 128-bit RC4; client CN=userid,OU=company,L=city,ST=state,C=US; issuer CN=issuer,DC=corp,DC=company,DC=lan
[23/Mar/2012:13:25:20 -0500] conn=44605 op=-1 msgId=-1 - SSL client bound as uid=userid,ou=employees,o=company
[23/Mar/2012:13:25:20 -0500] conn=44605 op=0 msgId=1 - BIND dn="" method=sasl version=3 mech=EXTERNAL
If I understand correctly that would be using the part 2 of your explanation as using the binary encoded PEM to authenticate the user. If I am not understanding that corretly please let me know.
Now the part that I am really not getting is that the usercertificate that is stored on the ID is as below:
dn: uid=userid,ou=employees,o=company
usercertificate;binary:: PCBmaWxlOi8vL2hvbWUvdXNlcmlkL0NlcnRzL3VzZXJpZC5iaW4
which decodes as: < file:///home/userid/Certs/userid.bin
So I'm still unclear as to what is going on here, or what I've done wrong. Have I set this up incorrectly such that Part 2 as you described it is not what I have setup above? Or am I missunderstanding part 2 entirely?
Thanks
Brian
Edited by: BrianS on Mar 23, 2012 12:14 PM
Just adding ---- to keep my instruction steps indented. -
Certificate based authentication with SSL load balancer
I've been asked to implement certificate-based authentication (CBA)
on a weblogic cluster serving up web services. I've read through
Chapter 10 (security) and understand the "Identity Assertion" concept.
Environment:
Weblogic 8.1 cluster fronted by a load-balancer that handles SSL and
uses sticky-sessions.
Question:
If the load balancer is used to handle SSL, do I still need to turn
on SSL on the weblogic cluster in order to use CBA? Is there another
way to request the client's certificate?
If the above is yes, what is the minnimal level of SSL? Does it have
to be two-way?
If SSL has to be turned on is there any reason to use the load
balancer's SSL? Is there still a performance benefit?I think the simplest and most secure way is to have the servers configured for
2-way ssl, since this would ensure that the certificate they receive and use for
authentication has been validated during the ssl handshake. In this case the load
balancer itself does not need to and cannot do the handshaking, and would need
to pass the entire SSL connection through to the WLS server (ie: act similar to
a router)
Pavel.
"George Coller" <[email protected]> wrote:
>
I've been asked to implement certificate-based authentication (CBA)
on a weblogic cluster serving up web services. I've read through
Chapter 10 (security) and understand the "Identity Assertion" concept.
Environment:
Weblogic 8.1 cluster fronted by a load-balancer that handles SSL and
uses sticky-sessions.
Question:
If the load balancer is used to handle SSL, do I still need to turn
on SSL on the weblogic cluster in order to use CBA? Is there another
way to request the client's certificate?
If the above is yes, what is the minnimal level of SSL? Does it have
to be two-way?
If SSL has to be turned on is there any reason to use the load
balancer's SSL? Is there still a performance benefit? -
Certificate Based Authentication - Questions and Authentication Modules
Hi Everyone
I'm trying to achieve a specific configuration using AM . I've installed the AM Server 7.1 on a AS9.1EE container and have another AS91EE container on another machine that has the agent configured.
The AM server is using a DS rep for configurations and dynamic profiles and using a AD rep for authentication.
What I now need to achieve is authentication base on one of these two way :
- user and password authentication (which is working)
- Certificate based authentication ( working on it )
To configure the Cert. Auth I've started reconfiguring the containers and agent to work in SSL, as said in the manuals. The manuals also say that the containers must have "Client Authentication Enabled", they don't say which ( either the server or agent container or both ) . Also I assume that "Client Authentication Enabled" is refering to the Http Listener configuration of that container.
When I enable it ( the Client Authentication ) on the http listener for either containers the https connection to that container stops working. In Firefox it simply prompts an error saying that the connection was "interrupted while the page was loading." . On IE, it prompts for a Certificate to be sent to the container and when I provide none, then it gives me the same error as Firefox. In both cases no page was presented.
Basically what I need is for both authentication methods described before to work! So, asking the certificate ( specially if it wasn't the AM asking for it ) without giving the user a chance to use a user/password combination isn't what is wanted.
From what I gathered the "Client Authentication" makes this http listener need a certificate to be presented always .
So, my first question is : is the documentation correct? Does this "Client Authentication" thingy need to be enabled at the listener level?
2- I'll probably need to code a costum module for this scenario I'm working in because of client requisits, but if possible I would like to use the provided module. Still, in case I need to make on, has anyone made a cert. auth module that they can provide me with so I have a working base to start with?
3- Is there a tested how-to anywhere on how to configure Cert. Based Authentication?
All for now,
Thank you all for your help
RpHi Rp,
We are using AM 7.1 with Certificate Authentication and LDAP Authentication. To answer your question, yes it is possible to use both method at the same time i.e. Use certificate first and then fallback to LDAP.
First you need to configure AM's webcontainer to accept the certificate. From your message it is clear that you have done that. The only mistake that you did is "made the Client Authentication required". I have done this in Sun WebServer 7.0 and Sun Application Server 7.0 (yeah that is old!!). You need to make the Client Authentication as optional. It means that Certificate will be transferred only when it is available otherwise Web Container will not ask for the Certificate. You will have to search Glassfish website or ASEE 9.1 manual to learn how to make the Client-Authentication Optional. You definitely need this authentication optional as Web Agent will be connecting to this AM and as far as I know they do not have any mechanism to do the Client Authentication.
Secondly, In AM 7.1, you will have to Set up the Authentication chaining. Where you can make Certificate Module as Sufficient and LDAP module as REQUIRED.
Thirdly, if you are using an non ocsp based certificate then change the ocsp checking in AMConfig.properties to false.
Fourth, You may have to write a small custom code to get the profile from your external sources. (if you need to then I can tell you how).
HTH,
Vivek -
Certificate Based Authentication and SSL
To whom it may concern,
I have installed SJES on Solaris 9 x386 (intel version). Everything is running fine, the mails are also coming and going.
Now, I need Certificate based authentication and SSL. I have downloaded versign.com trial certificate and have install it succesfully in the Messaging Server Console -- > Manage Certificates. The certificate is also visible in its tab.
Next, I followed the documentation and enable ssl by using ./configutil utility. And also restarted the server.
I am running my Messenger express (http) like this :
http://testing.xyz.com:8100
(I am using port 8100 for http access to mails). After restarting the mail server, I tried :
https://testing.xyz.com:8100 also,
http://testing.xyz.com:443 also,
https://testing.xyz.com:443 also,
but I cannot see the login page of the mail server. All the above mention url i tried and just given error "the connection was refused when attempting to contact testing.xyz.com. I CAN ONLY SEE THE LOGIN PAGE WHEN I WRITE THE OLD HTTP ADDRESS: i.e. http://testing.xyz.com:8100
And I also checked the logs and the server is having no problem in starting and there is not a single word regarding SSL enabling in the logs.
Please help me out, it's really a strange behaviour. I am using SunONE Messaging Server 6.0.
Thanking you,
Farhan Ahmed,
System Engineer
Dubai, UAE.Dear jay,
I am pasting a line from imap and http logs ... i don't know what this error means and how to resolve it.
[29/Dec/2004:14:42:45 +0100] testing imapd[888]: General Error: SSL initialization error: ASockSSL_Init: couldn't find cert Server-Cert (-8183)
strange thing is that my certificate name is lowercase server-cert and also i can see in the GUI console the certificate name as lowercase and I have also set this parameter encryption.rsa.nssslpersonalityssl = server-cert (all lowercase), but the error in the log tells it as "Server-Cert" !!!! though it is "server-cert"
i got this line from the http log:
[29/Dec/2004:14:42:47 +0100] testing httpd[894]: General Error: SSL initialization error: ASockSSL_Init: couldn't find cert Server-Cert (-8183)
I haven't missed the sslpassword.conf file step. I have placed the same password which i provided while generating the certificate request in the GUI.
Help me out what this errors means and how to resolve them. I have also copied the cert7.db and key3.db to /opt/SUNWms*/config directory from the /var/opt/mps/serverroot/alias
Thanking you,
Farhan Ahmed,
System Engineer,
Dubai Internet City, Dubai, UAE. -
C4C to CRM integration using HCI Certificate-based Authentication - 403 Forbidden
Hi Experts,
In reference from the discussion in this link (Quick Guide on using Certificates for Integrating C4C and ECC using HCI), we need suggestions on why we're getting 403-Forbidden error, what steps did we miss for our communication from C4C to CRM using HCI.
We already imported the necessary certificates in the iFlows/SSL Server/Client PSEs signed by Entrust (which is one of the supported CAs and our communication from CRM to C4C certificate-based authentication configuration is working fine) for HCI. We also mapped the HCI client certificate to the CRM user that we created (CODINTEG). Service IDOC is also registered and activated (SICF and SRTIDOC).
Below are the roles assigned to the user CODINTEG, and the mapping of HCI client certificate in SM30 and also the certificates imported in our SSL Server PSE. Just a note that we're not using SAP webdispatcher as a reverse proxy here for our C4C to CRM connection.
Thanks in advance.
Regards,
RajivHello Rajiv,
for test purpose and for eliminating error reasosns caused by user authorization rights you could assign first SAP_ALL to your communication user. If this works, you should reduce the rights again to a minimum...
Goto SU01 and edit the user CODINTEG. Goto Tab Profiles and within F4 help tab "Composite Profiles" search for SAP_ALL.
Best regards,
Berthold
Maybe you are looking for
-
everytime i try to download it says i need to contact system administrator but i am on system administrator but it still does not download
-
Solaris containers, am I thinking in the right way ?
Hi there, I've downloaded Solaris 10 and so far I really like what I see. With all the exploits appearing on Linux (local root exploits in the kernel for example) I'm seriously considering to replace my Debian GNU/Linux environment with Solaris 10. O
-
Help with flexible panels in Accordian
I can't seem to get my panels to work as flexible when viewed in a browser. The scroll bars are gone, but only the first line of text shows up. Here's what I tried... I changed CSS of AccordianPanelContent to this... .AccordionPanelContent { ove
-
Browse native directory from shared services
Is there a way to browse the browse native directory from shared services with a ldap browser? I cant get it working on shared_server_name port: 58080?
-
How can I queue multiple videos to be exported?
When I export a video (to .mp4) I've noticed there is a queue button. Does this allow you to edit mutiple videos and queue them up to be exported one after another? If so this would be helpful as I edit about 5 videos at a time and have to manually e