ISE; machine based dot1x authentication not working

Hi there,
I'm currently trying out dot1x authentication with MDA. The phone is currently authenticated via MAB. I succeeded to do the same with a Win7 workstation, but now I have a problem with true dot1x auth. Whenever the client tries to authenticate to the ISE it is using the notorious "host/" prefix. I read in the ACS 5.2 user guide that there is an option to crop it. I tried to find the same feature in the ISE, but it seems there is none.
I have the authentication policy configured to use a certificate authentication profile as identity source when the method is dot1x without any additional conditions.
In this profile I tried several options, including the common name, subject, subject alternative name. Nothing helped.
Does anybody have a tip on how to solve this?
Thanks in advance

If I understood correctly I don't need to create an external identity source when using the Certificate Authentication Profile feature.
This is what I got from the documentation:
"Certificate authentication profiles are used in authentication policies for certificate-based authentications in place of identity sources to verify the authenticity of the user."
I intend to use machine based authentication without contacting an external identity source.
I also ensured the root CA certificate is selected to be used for EAP-TLS authentication.
This brings me to another question.
If the CA issuing machine or user certificates is itself an intermediate CA do I have to install a chained certificate (intermediade CA+root CA) in the ISE or both CA certificates separately?
Thanks in advance
Regards,
Patrick

Similar Messages

Rule based ATP is not working for Components

Hi All,
Our requirement is to do availability check through APO for Sales order created in ECC,so we are using gATP.
Requirement: We are creating salesorder for BOM header (Sales BOM) and avaialbility check should happen for components i.e. Product avalaibility & Rule based substitution.
Issue: Product availiabilty is working for components but rules based substituion is working, mean Rules are not getting determind for components.
Settings:
- Header doesnot exist in APO and compnents do exist in APO
- Availability check is not enabled for header item category and enabled for Item category for components
- Rules have been created for Components in APO
- Rule base ATP is activated in Check instructions
We have also tried MATP for this i.e. PPM created in APO but still didn't get the desired result.
If we create salesorder for the component material directly then Rule based ATP is happening, so for components Rule based ATP is not working.
How do we enable enable Rulesbased ATP for components, i mean is there any different way to do the same.
Thanks for help.
Regards,
Jagadeesh

Hi Jagdeesh,
If you are creating BOM in ECC and CIFing PPM of FG/Header material to APO, I think you need to CIF Header material, too, with material integration model.
Please include header material in you integration models for material, SO and ATP check as well.
For component availability check, you can use MATP; but for MATP, FG should be in APO. You need not to CIF any receipts of FG (stock, planned orders, POs etc), so that MATP will be triggered directly. Then maintaining Rules for RMs will enable to select available RMs according to the rule created.
Regards,
Bipin

I just fix my macbook air because it was kernel panic. They changed the hard drive. I could not back up with Time Machine, because it did not work and I had over Adobe creative suite 5 design premium student. But I finished my studies last year and I'd li

I just fix my macbook air because it was kernel panic. They changed the hard drive. I could not back up with Time Machine, because it did not work and I had over Adobe creative suite 5 design premium student. But I finished my studies last year and I'd like to know how to get the serial number for me to reinstall Adobe creative suite 5 design premium when I am no longer study because I would still like the used? It is not fair if I do anymore because I really need.

You can download Creative Suite 5 here:
Other downloads
To deal with the issue of the serial number and using it again, you'll have to use Web Chat. Here's a link:
Adobe ID, sign in, and account help
See the bottom of the page for a link

[svn] 1720: Bugs: LCDS-304 - Authentication not working in all cases when using security constraint with NIO endpoints .

Revision: 1720
Author: [email protected]
Date: 2008-05-14 14:50:06 -0700 (Wed, 14 May 2008)
Log Message:
Bugs: LCDS-304 - Authentication not working in all cases when using security constraint with NIO endpoints.
QA: Yes
Doc: No
Details:
Update to the TomcatLoginCommand to work correctly with NIO endpoints.
Ticket Links:
http://bugs.adobe.com/jira/browse/LCDS-304
Modified Paths:
blazeds/branches/3.0.x/modules/opt/src/tomcat/flex/messaging/security/TomcatLoginCommand. java

Revision: 1720
Author: [email protected]
Date: 2008-05-14 14:50:06 -0700 (Wed, 14 May 2008)
Log Message:
Bugs: LCDS-304 - Authentication not working in all cases when using security constraint with NIO endpoints.
QA: Yes
Doc: No
Details:
Update to the TomcatLoginCommand to work correctly with NIO endpoints.
Ticket Links:
http://bugs.adobe.com/jira/browse/LCDS-304
Modified Paths:
blazeds/branches/3.0.x/modules/opt/src/tomcat/flex/messaging/security/TomcatLoginCommand. java

I baught Seagate Backup plus 2T hard drive to use as my Backup time machine. But its not working when i connect to time machine its not coping files, it keep saying preparing files. Can someone help me please...

i baught Seagate Backup plus 2T hard drive to use as my Backup time machine. But its not working. when i connect to time machine its not coping files, it keep saying preparing files. Can someone help me please...

Please read this whole message before doing anything.
This procedure is a diagnostic test. It’s unlikely to solve your problem. Don’t be disappointed when you find that nothing has changed after you complete it.
The purpose of the test is to determine whether the problem is caused by third-party software that loads automatically at startup or login, by a peripheral device, by a font conflict, or by corruption of the file system or of certain system caches.
Disconnect all wired peripherals except those needed for the test, and remove all aftermarket expansion cards, if applicable. Start up in safe mode and log in to the account with the problem. You must hold down the shift key twice: once when you turn on the computer, and again when you log in.
Note: If FileVault is enabled, or if a firmware password is set, or if the startup volume is a Fusion Drive or a software RAID, you can’t do this. Ask for further instructions.
Safe mode is much slower to start up and run than normal, with limited graphics performance, and some things won’t work at all, including sound output and Wi-Fi on certain models. The next normal startup may also be somewhat slow.
The login screen appears even if you usually login automatically. You must know your login password in order to log in. If you’ve forgotten the password, you will need to reset it before you begin.
Test while in safe mode. Same problem?
After testing, restart as usual (not in safe mode) and verify that you still have the problem. Post the results of the test.

Promemoria geolocalizzati non funzionano con iOs 7 location-based reminders do not work with iOs7

promemoria geolocalizzati non funzionano con iOs 7
location-based reminders do not work with iOs7

Hi konekotron,
See this manual about using the Apple Wireless Keyboard with your iPad -
iPad User Guide
http://manuals.info.apple.com/MANUALS/1000/MA1595/en_US/ipad_user_guide.pdf
See page 25 and the section on using International Keyboards on page 125.
A similar guide for the iPhone -
iPhone User Guide
manuals.info.apple.com/MANUALS/1000/MA1565/en_US/iphone_user_guide.pdf
See page 28.
Thanks for using Apple Support Communities.
Best,
Brett L

Cisco Ise Central Web authentication not working

Hello Guys,
CWA is not working. It says that authentication suceeded but posture status is pending. No error in my Monitor--authentication. Checking it in my Windows 7, it does not shows the CWA portal.
What might be the possible problem of this.?
thanks

Kindly review the below links:
http://www.cisco.com/en/US/products/ps11640/products_configuration_example09186a0080ba6514.shtml
http://www.cisco.com/en/US/products/ps11640/products_configuration_example09186a0080bead09.shtml

Sg300 - 802.1x NPS - mac authentication not working

I configured 802.1x on a sg300 switch. It is working very well with some Windows 7 machines and a Windows Server 2008 NPS server.
Now I tried to get the MAC authentication running, on a 3850X it is working without problems, but every access request sent from the SG300 is declined.
My current port configuration on the SG300:
interface fastethernet1
dot1x guest-vlan enable
dot1x max-req 1
dot1x reauthentication
dot1x timeout quiet-period 10
dot1x authentication 802.1x mac
dot1x radius-attributes vlan static
dot1x port-control auto
switchport mode access
On the Windows NPS server there is following error to see:
Authentication Details:
   Connection Request Policy Name:   Secure Wire
   Network Policy Name:       -
   Authentication Provider:       Windows
   Authentication Server:        myradius.local
   Authentication Type:       -
   EAP Type:           -
   Account Session Identifier:       30353030399999
   Reason Code:           1
   Reason:               An internal error occurred. Check the system event log for additional information.
There is compared to the message from the 3850 the authentication type missing (PAP) and a not very helpful error message displayed...

Still not working.
I tried different settings and (also older) software versions on the SF302-08P.
Also started to change the settings on the NPS (though it is working with the 3850X!), without success.
The NPS reports following error:
Schannel:
The following fatal alert was received: 40.
EventID 36887
If I search for this error, every source is pointing to certificate errors, but there should not be any certificate involved?!
... is this a bug on the SF302-08P?

Ldap authentication not working for Solaris 8 host - Help!

Greetings folks,
I just recently migrated a host to use LDAP authentication. The only difference between this host and the rest of the hosts in the environment that I've converted to use LDAP is that this one is running Solaris 8.
Here's the steps I took to migrate it (though, I used the same steps for another Sol8 host in another environment and it works fine):
ldapclient -P stg -d mydomain.com -D cn=proxyagent,ou=profile,dc=mydomain,dc=com -w secret 192.168.1.69
My /etc/nsswitch.conf looks like this:
passwd: files ldap
group: files ldap
My /etc/pam.conf looks like this:
login auth requisite pam_authtok_get.so.1
login auth required pam_dhkeys.so.1
login auth sufficient pam_unix_auth.so.1
login auth required pam_ldap.so.1
sshd auth requisite pam_authtok_get.so.1
sshd auth sufficient pam_unix_auth.so.1
sshd auth required pam_ldap.so.1
other auth requisite pam_authtok_get.so.1
other auth required pam_dhkeys.so.1
other auth sufficient pam_unix_auth.so.1
other auth required pam_ldap.so.1
passwd auth sufficient pam_passwd_auth.so.1
passwd auth required pam_ldap.so.1
I've also cleared out the local user accounts for my human users, so there aren't any more passwd or shadow entries (yes, I ran pwconv). I also cleaned out the /etc/group entries for the same users. The machine appears to be configured properly, because I can run various DS commands that indicate this:
hostname# getent passwd user1
user1::1001:1001:User 1:/opt/home/user1:/bin/bash
hostname# ldaplist -l passwd user1
dn: uid=user1,ou=people,dc=mydomain,dc=com
shadowFlag: 0
userPassword: {crypt}(removed)
uid: user1
objectClass: posixAccount
objectClass: shadowAccount
objectClass: account
objectClass: top
cn: user1
uidNumber: 1001
gidNumber: 1001
gecos: User 1
homeDirectory: /opt/home/user1
loginShell: /bin/bash
However, in the end, actual logins to this host fail via ssh. Snooping the traffic reveals that all the right info is being handed back to the client, including the crypt'ed password hash, uid, etc. just like I see with other hosts that work.
Any ideas?
Thanks!
Patrick

I assume you have applied lastest kernel patch and 108993 to this Solaris8 machine, and its nss_ldap.so.1 and pam_ldap.so.1 are the same as the other Solaris8 LDAP clients that are working for ssh via LDAP auth.
1) Please replace "objectClass: account" with "objectClass: person", I know SUN ONE DS5.2 likes "person".
2) Did you test and verify telnet/ftp/su working? but SSH not working?
3) If telnet/ftp/su all worked, and SSH (SUN-SSH or OpenSSH), make sure you have "UsePAM yes" in sshd_config and restart sshd.
4) It is not a must I think but normally I will add "shadow: files ldap" to /etc/nsswitch.conf, restart nscd after that.
5) Whenever ldapclient command is run and ldap_cachemgr is restarted, I usually also restart nscd and sshd after that, if not testing result may not be accurate as nscd is still remembering OLD stuffs cached which could be very misleading.
6) You may use "ssh -v userid@localhost" to watch the SSH communications, on top of your usual "snoop"ing of network packets.
7) Use the sample pam.conf that is meant for pam_ldap from Solaris 10 system admin guide with all the pam_unix_cred.so.1 lines commented out. This works for me, there is no sshd defintions as it will follow "other".
http://docs.sun.com/app/docs/doc/816-4556/6maort2te?a=view
Gary

J2EE and user authentication not working

Hi,
has anyone gotten the basic/form based authentication to
work in the latest version of the 9iAS?
Oracle9iAS (9.0.2.0.0)
I've read all the posts and articles from orionsupport.com
BUT it still does not work.
Support Folks from ORacle: Where is the latest documentation
for the Server ???? Everything seems outdated??
cheers,
Vijay

Hi,
You can change User and password through SU01 through UME. and also read SNote: Note 891614 - Login problems / Expired password
Regards
Thomas

Wireless with PEAP Authentication not working using new NPS server

All,
We are planning to migrate from our old IAS server to new NPS server. We are testing the new NPS server with our wireless infrastructure using WISM. We are using PEAP with server Cert for authentication. For testing purpose we are doing user authentication but our goal is to do machine authentication. On client side we are using Windows XP, Windows 7 & iPAD’s
I believe I have configured the NPS & CA server as per the documents I found on Cisco support forum & Microsoft’s site.
But it is not working for me. I am getting the following error message on the NPS server.
Error # 1
=======
Cryptographic operation.
Subject:
            Security ID:                 SYSTEM
            Account Name:                       MADXXX
            Account Domain:                    AD
            Logon ID:                    0x3e7
Cryptographic Parameters:
            Provider Name:          Microsoft Software Key Storage Provider
            Algorithm Name:         RSA
            Key Name:      XXX-Wireless-NPS
            Key Type:       Machine key.
Cryptographic Operation:
            Operation:       Decrypt.
            Return Code: 0x80090010
Error # 2
======
An error occurred during the Network Policy Server use of the Extensible Authentication Protocol (EAP). Check EAP log files for EAP errors.
I was wondering if anyone has any insight on what is going on.
Thanks, Ds

Scott,
I have disabled MS-CHAP v1 & only MS-CHAP v2 is enabled on Network Policies > Constraints.
I disabled validate Certificate on Windows 7 and tried to authenticate, it is still failing. Here is the output from the event viewer:
Cryptographic operation.
Subject:
Security ID: SYSTEM
Account Name: MADHFSVNPSPI01$
Account Domain: AD
Logon ID: 0x3e7
Cryptographic Parameters:
Provider Name: Microsoft Software Key Storage Provider
Algorithm Name: RSA
Key Name: DOT-Wireless-NPS
Key Type: Machine key.
Cryptographic Operation:
Operation: Decrypt.
Return Code: 0x80090010
Network Policy Server denied access to a user.
Contact the Network Policy Server administrator for more information.
User:
Security ID: AD\mscdzs
Account Name: AD\mscdzs
Account Domain: AD
Fully Qualified Account Name: AD\mscdzs
Client Machine:
Security ID: NULL SID
Account Name: -
Fully Qualified Account Name: -
OS-Version: -
Called Station Identifier: 64-ae-0c-00-de-f0:DOT
Calling Station Identifier: a0-88-b4-e2-79-cc
NAS:
NAS IPv4 Address: 130.47.128.7
NAS IPv6 Address: -
NAS Identifier: WISM2B
NAS Port-Type: Wireless - IEEE 802.11
NAS Port: 29
RADIUS Client:
Client Friendly Name: WISM2B
Client IP Address: 130.47.128.7
Authentication Details:
Connection Request Policy Name: Secure Wireless Connections
Network Policy Name: Secure Wireless Connections
Authentication Provider: Windows
Authentication Server: MADHFSVNPSPI01.AD.DOT.STATE.WI.US
Authentication Type: PEAP
EAP Type: -
Account Session Identifier: -
Logging Results: Accounting information was written to the local log file.
Reason Code: 23
Reason: An error occurred during the Network Policy Server use of the Extensible Authentication Protocol (EAP). Check EAP log files for EAP errors.
Attached are EAP logs & debug logs from the controller.
Thanks for all the help. I really appreciate.

SSO Authentication Not Working

Our configuration is HTML DB v1.6.0.00.87 running on our host name hostx with port 7779 and the OAS HTTP server running on hostx on port 7778.
I had our administrator follow the instructions in http://www.oracle.com/technology/products/database/htmldb/howtos/sso_partner_app.html for registering HTML DB as a partner application. I have one HTML DB application setup for an authentication scheme of "Based on authentication scheme from gallery:Oracle Application Server Single Sign-On (HTML DB as Partner Application)". When I attempt to run it from Application Builder, I get the error below and it then directs me to http://hostx:7779/pls/our_dad/f? and the "p=" is missing for some reason and gives me a "Error ERR-7620 Could not determine workspace for application ()." error.
Error in portal_sso_redirect: missing application registration:
Error p_partner_app_name:g_listener_token:HTML_DB:hostx:7778
Please register this application as described in the installation guide.
Redirecting to login server for authentication.
The URL for running the application is: http://hostx:7779/pls/our_dad/f?p=101:1
My system administrator has checked to see the HTML_DB listener token is set correctly. When she queried against the wwsec_enabler_config_info$ table the token looks OK. It returns 7779 as the port number, but the error message above is listing 7778. Why?
What can we look at to determine the cause of this problem? I am struggling because I am not familiar with the Oracle Application Server environment.

Now SERVER_PORT and HTTP_PORT are both 7778 in SQL Workshop. They are both pointing to the port that HTTP is running on. Is this correct? I would assume not because the HTML DB application that uses the SSO Partner App. scheme is still giving me the same error:
Error in portal_sso_redirect: missing application registration:
Error p_partner_app_name:g_listener_token:HTML_DB:hostx:7778
Please register this application as described in the installation guide.
Redirecting to login server for authentication.
If HTTP is running on port 7778, then should HTTP_PORT be 7778? I assume, yes.
If HTML DB was installed on port 7779, then should SERVER_PORT be 7779? I assume, yes.
What sets the values of SERVER_PORT and HTTP_PORT within HTML DB?
My admin reran regapp.sql and defined the HTML_DB listener token as HTML_DB:hostx:7779, yet based on the error above HTTP is looking on port 7778 for HTML DB and not finding it. Am I interpreting the error correctly?

After restore from Time Machine Software Upgrade is not working.....

After I restored my complete system from Time Machine, some parts of it is not working and announcing problem to start, e.g. Software Update, My Day from Office 2008....what should I do?

Hi, and welcome to the forums.
First, are you running Leopard or Snow Leopard? Your settings at the bottom of your post say Snow Leopard, but this is the +Leopard > Time Machine+ forum, so I'm not sure which is right.
Did you do the full system restore, starting by booting from your OSX disc? If not, what exactly did you do?
Exactly what is wrong with Software Update? What happens, or doesn't happen?

Time Machine backup over wifi not working after upgrade to 10.6.3

I have a firewire external hard disk connected to directly into my imac which I use for back-up. The imac is wired into an ethernet LAN. I also backup my MacBook Pro to the same hard disk. The MacBook is connected to the backup disk via a wifi link to a router. All has been working well until I upgraded Snow Leopard to 10.6.3 and now the back-up is not working for the MacBook. The same thing happened after the last point release upgrade but at the time I thought it must have been user error. Last time I had to trash the backups and start from scratch. Can anyone shed any light?

Try reselecting the drive (from the laptop) via TM Preferences > Select Disk (first select the "none" drive, then the correct one).
If that doesn't help, try a "full reset" of TM on the laptop, per #A4 in the Time Machine - Troubleshooting *User Tip,* also at the top of this forum.

Oracle 9i, 10g, 11g on same machine...11g not working....

Hello All,
I have a dilemma.
I have a server that originally had 9i client installed.
We installed 10g and ODP .Net to gain use of some new funcionality used in .Net and batch processing.
Halfway through testing we realized that 10g's version of ODP.Net has a memory leak issue.
11g was found to correct this issue so we installed it on the server as well and it solved the problem.
Life was good.
9i, 10g, 11g, and ODP.net were all working well.
However, this was a test server. We now needed to go through the same installs for the production server.
On the night of the software install someone made a mistake and installed 10g on the test server again for the second time, after 11g was already installed.
So at this point the test server has:
9i
10g
11g
10g
And now many of the applications on the server are not working correctly and no amount of config changes seemed to fix it.
So we decided to uninstall 11g and then 10g and start over.
At this point we have 9i and 10g installed and the applications are working correctly.
We have tried to reinstall 11g and configure multiple times and 11g will simply not work.
I am stumped at this point. The application that actually does use 11g and ODP.Net simply stops executing at the point it attempts to open a connection with NO ERRORS.
An Exception does occur but there are no contents or error messages in the exception. I have never had this happen before. How do you fix an error you dont have?
So at this point I am just reaching out to see if anyone might have a suggestion. The next step might be to perform a system restore to the point where life was good (before 10g was installed a 2nd time after 11g).
Anyone?

Thanks gdarling.
I was hoping to just start the thread and go from there as sometimes information overload makes people pass on reading the whole post. I am glad you still read it:)
To start off with here are the entries (unedited in my PATH variable):
E:\oracle11\product\11.2.0\client_1\bin;E:\oracle102\product\10.2.0\client_1\bin;E:\oracle\product\10.2.0\client_1;E:\Orant9i\bin;
I recently moved the 9i path back to the front in order to get the other applications on the server working again as some were erroring out with this when 11.2 was first:
*"OCIEnvCreate failed with return code -1 but error message text was not available"*
I searched for a long time as to the cause of this error but did not turn up much. Most of the posts just mention that the client was installed incorrectly.
Policy files:
I compared the assembly of the "working" server to the "bad" server and they appear identical as far as I can see.
Directories
-9i has one directory
-As you can probably see from the path, it still looks like there are 2 installations of 10g on the server. As well as remnants of three directories that resemble 10g install directories.
-11g has one directory
Couple observed behaviors:
1.
running sqlplus from the 9i and 10g directories works.
running sqlplus from the 11g directory results in the following error:
E:\oracle11\product\11.2.0\client_1\bin>sqlplus.exe
Error 6 initializing SQL*Plus
SP2-0667: Message file sp1<lang>.msb not found
SP2-0750: You may need to set ORACLE_HOME to your Oracle software directory
2.
Running tnsping works from the 9i and 10g directories
Running tnsping from 11g results in this:
TNS Ping Utility for 32-bit Windows: Version 11.2.0.1.0 - Production on 13-MAY-2
010 09:32:32
Copyright (c) 1997, 2010, Oracle. All rights reserved.
Message 3511 not found; No message file for product=NETWORK, facility=TNSTNS-035
05: Message 3505 not found; No message file for product=NETWORK, facility=TNS
*(NOTE: THIS ERROR ALSO OCCURS ON THE "GOOD" SERVER)*
Registry:
There is a difference in the registry.
The "good" server has this entry in the ORACLE area:
KEY_OraClient10g_home1
KEY_OraClient11g_home1
where as the "bad" just has
KEY_OraClient10g_home1
Both servers have ODP.Net folder containing:
2.112.1.0
There are also other entires in this registry area but they are the same.
It wasn't our original intention to have all three clients on the same machine. Halfway through our system testing of a new process we realized the 10g has a memory leak which was corrected in 11g.
So we just installed 11g. These are supposed to be able to coexist right?
It sounds like we could have just installed 11g...
I am going to look into your suggestions.
As far as sysinternals I am a novice. And I am assuming it would need to be loaded on the server...is that correct? Or should I be using it on my local machine with the application in question running?
Getting more software (sysinternals) installed on the server might be a hurdle...
Thanks again

ISE; machine based dot1x authentication not working

Similar Messages

Maybe you are looking for