Limiting Concurrent RADIUS Logins - Windows NPS or Aerohive

Has anyone overcome the challenge of only allowing a specific number of devices to connect to the network via Windows NPS (2012) or Aerohive settings? I've seen a bunch about folks' attempts to get it to work, but nothing on successful methods/configuration. Is there an attribute that can get passed back to the client indicating whether or not the login is allowed based on already active sessions, or something similar?
This topic first appeared in the Spiceworks Community

Hi Dennis,
>>Do we just use PEAP with a cert minted by our own in-house CA?
Yes. Just build the Enterprise CA in your intranet. All domain-joined will trust this CA by default.
>> Or, can we not even bother w PEAP and just use another auth method?
Yes. We can use MSCHAPv2. But PEAP is more secure than MSCHAPv2.
Besides, here is a checklist about how to use NPS to secure wireless network,
Checklist: Configure NPS for Secure Wireless Access
http://technet.microsoft.com/en-us/library/cc771696(v=WS.10).aspx
Best Regards.
Steven Lee Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

Similar Messages

How to set two radius servers one is window NPS another is cisco radius server

how to set two radius servers one is window NPS another is cisco radius server
when i try the following command, once window priority is first , i type cisco radius user name, it authenticated fail
i can not use both at the same time
radius-server host 192.168.1.3 is window NPS
radius-server host 192.168.1.1 is cisco radius
http://blog.skufel.net/2012/06/how-to-integrating-cisco-devices-access-with-microsoft-npsradius/
conf t
no aaa authentication login default line
no aaa authentication login local group radius
no aaa authorization exec default group radius if-authenticated
no aaa authorization network default group radius
no aaa accounting connection default start-stop group radius
aaa new-model
aaa group server radius IAS
server 192.168.1.1 auth-port 1812 acct-port 1813
server 192.168.1.3 auth-port 1812 acct-port 1813
aaa authentication login userAuthentication local group IAS
aaa authorization exec userAuthorization local group IAS if-authenticated
aaa authorization network userAuthorization local group IAS
aaa accounting exec default start-stop group IAS
aaa accounting system default start-stop group IAS
aaa session-id common
radius-server host 192.168.1.1 auth-port 1812 acct-port 1813
radius-server host 192.168.1.2 auth-port 1812 acct-port 1813
radius-server host 192.168.1.3 auth-port 1645 acct-port 1646
radius-server host 192.168.1.3 auth-port 1812 acct-port 1813
privilege exec level 1 show config
ip radius source-interface Gi0/1
line vty 0 4
authorization exec userAuthorization
login authentication userAuthentication
transport input telnet
line vty 5 15
authorization exec userAuthorization
login authentication userAuthentication
transport input telnet
end
conf t
aaa group server radius IAS
server 192.168.1.3 auth-port 1812 acct-port 1813
server 192.168.1.1 auth-port 1812 acct-port 1813
end

The first AAA server listed in your config will always be used unless/until it becomes unavailable. At that point the NAD would move down to the next AAA server defined on the list and use that one until it becomes unavailable and then move to third one, and so on.
If you want to use two AAA servers at the same time then you will need to put a load balancer in front of them. Then the virtual IP (vip) will be listed in the NADs vs the individual AAA servers' IPs.
I hope this helps!
Thank you for rating helpful posts!

AD Radius 802.1x Login Window Connection Problems

Mac Mini/10.10.1
I'm using two profile manager profiles for testing:
1. AD Certificate
    Installs certificate for AD Certificate Authority.
     Requests Machine Certificate from CA
2. Network Settings
     Network Payload:
          Interface WIFI
          SSID our 802.1x SSID
          Auto Join - Checked
          Security Type - WPA / WPA2 Enterprise
          Use as Login Window Config - Checked
          EAP Types: PEAP
          Use Directory Auth - Checked
Issue:
     Certificate services work fine, login window works fine. User is able to login and authenticate to wireless. However users are experiencing problems with computer sleep, roaming on network etc. I can simulate their problems by turning off air port and back on while logged in. What I'm seeing happen is that when airport is turned back on, it begins to connect to the 802.1x wireless network but does not authenticate does not receive an IP address. eventually resulting in self assigned address. If I press the connect button it will then authenticate and work as expected.
Why is it necessary to press the connect button, why does it not automatically connect? Am I doing something incorrect or is this normal behavior?
Going into network preferences, choosing wifi adapter and clicking connect is too much to expect from my users. And it would be annoying even for me if this happened every time I went offline.
Thank you for suggestions.
Joe

Hi Geoffrey,
I would like to know if
EAP-TLS wireless authentication has been used since it uses user and computer certificates to authenticate wireless access clients.
Please try to use NPS wizard to configure 802.1x wireless connection,
and
you will find that it
creates new connection request policy and network policy. Network policy NAS Port type will be "Wireless -Other OR Wireless -IEEE 802.11".If
you
need filter by user and computer account, the log should show both authenticate user and machine account name.
EAP-TLS-based Authenticated Wireless Access Design
http://technet.microsoft.com/en-us/library/dd348478(WS.10).aspx
Regards, Rick Tan

How to view the login log in window NPS after login cisco switch and without SQL server database

how to view the login log in window NPS after login cisco switch and without SQL server database
in summary
there is only log with event id 4400
A LDAP connection with domain controller XCPAWS20.cyberport.noc for domain NOC2 is established.

Hi adil,
For your issue, you can create a custom security token service (STS) and then set up a trust relationship between a SharePoint 2010 farm and the custom STS.
For more information, you can refer to the articles:
http://forums.asp.net/t/1335229.aspx?Sharing+Authentication+Ticket+Between+ASP+NET+and+Sharepoint
https://msdn.microsoft.com/en-us/library/office/ff955607(v=office.14).aspx
http://www.paraesthesia.com/archive/2011/02/01/working-with-windows-identity-foundation-in-asp-net-mvc.aspx/
Best Regards,
Eric
Eric Tao
TechNet Community Support

Parental time limits on has a bug that gets stuck at login window

I put time limits on my daughters account, both a bedtime and a maximum number of hours per day. No other parental controls activated. It worked for a while, then developed a bug where once it reaches the "you're out of time" window, logging in just comes up with another login window ad nauseam until I restart and deactivate time limits in system preferences. It does so if I authorize her for another hour and then she logs in, and it also does so even if I simply try to log into my own account, and it even does so after a restart, if I again authorize her for another hour.
Any suggestions? Trash the preferences file? Where exactly is the pfile to trash?

I put time limits on my daughters account, both a bedtime and a maximum number of hours per day. No other parental controls activated. It worked for a while, then developed a bug where once it reaches the "you're out of time" window, logging in just comes up with another login window ad nauseam until I restart and deactivate time limits in system preferences. It does so if I authorize her for another hour and then she logs in, and it also does so even if I simply try to log into my own account, and it even does so after a restart, if I again authorize her for another hour.
Any suggestions? Trash the preferences file? Where exactly is the pfile to trash?

My MacBook Pro Retina's Bluetooth chipset unknown/odd login message on the login screen states Login Window Authentication Login window Name edit text has keyboard focus. In addition, the login screen is not remembering me

I have been experiencing several issues with my MacBook Pro Retina mid 2012. My MBPR is scheduled to go into the depot. However, I am wondering if anyone may be able to shed light on a few issues as this is the third "official" time my MBPR is going back for service ("one depot" trip; "one authorized" dealer; several in-store visits).
My Bluetooth is stating that the Bluetooth Chipset is Unknown (0). I also have had Bluetooth Preferences mysteriously change on me. In addition, while Bluetooth is off there are two serial modems turning on. I have turned them off, but they continue to pop up.
In addition, when I log in, my MBPR is not remembering me and my login name is not appearing on the slate-gray screen. The name and password are blank and the following message appears in the lower left hand corner. "login window authentication login window Name edit text has keyboard focus." As a side note, I am the only user. The login issue is a recent occurrence as we just totally wiped it again via a Command + R, and I don't believe I have an accessibility setting set to anything that would cause this, but wanted to check.
Should I be concerned here? Has anyone else had issues like this? I don't want to worry if I don't have to. I have had so many issues over the course of nine months. 5-6 wipes. Airport card replaced and I am about to pull my hair out if my MBPR doesn't come back worldly like clock work this time. I just can't send my days trying to get a $2300 product to work for me any longer. No idea what is wrong with it, but it is driving me insane. Cross your fingers for me and any guidance you have or thoughts would be welcomed. Thank you. EMM

A few more issues...
In Console, the following is greyed out:
User and Diagnostic reports
Com.apple.launchd.peruser.0
Com.apple.launchd.peruser.88
Com.apple.launchd.peruser.89
Com.apple.launchd.peruser.92
Com.apple.launchd.peruser.97
Com.apple.launchd.peruser.200
Com.apple.launchd.peruser.201
Com.apple.launchd.peruser.202
Com.apple.launchd.peruser.212
*[user logs are accessible]
Krb5kdc
Radius
My guest files are locked, but again I am the administrator of MBPR.
I am worried about a keystroke logged or at least, trying to rule it out.
Also:
Mdworker32(225) [and other mdworker numbers] are sandboxing; stating deny Mach-lookup
Com.apple.Powermanagement.control, etc. long attachment with those files with version: ??? (???).
Postinstall: removing applications/Microsoft Office 2011/Microsoft Outlook.app
WARNINGS in Console include:
[NSImage compositeToPoint:fromRect:operation:fraction:] is deprecated in MacOSX 19.8 and later. Please use -[NSImage drawAtPoint:fromRect:operation:fraction] instead.
There are a ton of other warnings. Before I go through this again, can someone tell me if this is normal (all of it -- above too); or if these are symptoms is a keystroke logger or hardware issues?
I ask because originally, when my computer went in for diagnostics (more than once), Apple stated the hardware was fine (other than Airport Card -- finally). However, if I've done 5-6 total wipes; created new users; do not have sharing set-up; have not played around in Terminal; and am up-to-date with versions -- and various issues KEEP COMING BACK -- I am left wondering if a keystroke logger would be possible here?!? I thought maybe a faulty logic board, but why would diagnostics be okay, then? Not trying to be hyperbole, just desperate.
Please help me rule keystroke logger out or at least, tell me so I know, so I can take appropriate action. If you think it could be the logic board with symptoms above, that would be a great too.
All I want to do is use the computer as intended, but I can't seem to get a real answer, so after nine months -- I am turning to the communities to see if anyone -- anyone at all -- can help. The last thing I can do is have the MBPR come back from the depot and the same thing occur. Any guidance or advice would be so gratefully appreciated.

On-Screen Keyboard at the Login Window

Good morning,
We're looking at deploying a number of Mac Mini machines linked up to touchscreens for "Kiosks" where users have access to a web browser for email, but not much else.
Once logged in, the On-Screen Keyboard works very well, and we can make sure it's running all the time, however we can't get it to run over the Login Window, so the machine still requires a Keyboard and Mouse.
Does anyone know how we can get this application to run over the Login Window? I've tried getting launchd to spawn it but for some reason it gives the error that the application can't be found:
11/06/2010 09:47:24 com.apple.launchd[1] (On-Screen Keyboard[815]) posix_spawn("/System/Library/Input\ Methods/KeyboardViewer.app", ...): No such file or directory
11/06/2010 09:47:24 com.apple.launchd[1] (On-Screen Keyboard[815]) Exited with exit code: 1
wierd..
Anyway, the application has a CodeSignature section, so I can't see the loginwindow disliking it. Any thoughts?
Thanks in advance

It's possible but the on-screen keyboard should support some pre-login limitations. Mac OS X 10.5 introduced the ability to run a launchd agent while the login screen is showing. Pre-login launchd agents are privileged programs; you must be carefully to maintain system security. For example, Typical On-Screen Keyboard for Mac OS X ( http://www.typicsoft.com/en/Products/On-Screen-Keyboard.html ) and Typical Virtual Keyboard for Mac OS X ( http://www.typicsoft.com/en/Products/Virtual-Keyboard.html ) both support the login screen. They are for Intel only. You can download it from http://www.typicsoft.com

On startup of Mac Mini running OS Mavericks login windows are invisible. Login is possible but there are no white boxes for username and password. Keyboard inputs also do not display.

Mac Mini with 2 Ghz Intel Core i7 running OS X 10.9.1. Recent problem with startup screen where I get a gray startup screen that is blank and does not show the login windows for username or password. Mousing over where they should be does provide a cursor change and I can click into the invisible window and login. Also, I can just type the information and hit enter and login without problems but the keystrokes do not appear either. This is not a big problem if I make sure that I type my login information correctly, but if I make a mistake it can be difficult make sure I am in the right place before I retype. Any ideas why the screen is just gray and does not show the windows? Once I type in the login info in the invisible windows and hit enter the computer starts up, loads finder, and runs without any other noticeable problems.

Please read this whole message before doing anything.
This procedure is a diagnostic test. It’s unlikely to solve your problem. Don’t be disappointed when you find that nothing has changed after you complete it.
The purpose of the test is to determine whether the problem is caused by third-party software that loads automatically at startup or login, by a peripheral device, by a font conflict, or by corruption of the file system or of certain system caches.
Disconnect all wired peripherals except those needed for the test, and remove all aftermarket expansion cards, if applicable. Start up in safe mode and log in to the account with the problem. You must hold down the shift key twice: once when you boot, and again when you log in.
Note: If FileVault is enabled, or if a firmware password is set, or if the boot volume is a Fusion Drive or a software RAID, you can’t do this. Ask for further instructions.
Safe mode is much slower to boot and run than normal, with limited graphics performance, and some things won’t work at all, including sound output and Wi-Fi on certain models. The next normal boot may also be somewhat slow.
The login screen appears even if you usually login automatically. You must know your login password in order to log in. If you’ve forgotten the password, you will need to reset it before you begin.
Test while in safe mode. Same problem?
After testing, reboot as usual (not in safe mode) and verify that you still have the problem. Post the results of the test.

802.1x Login Window Profile..

I'm attempting to create a package that I can install at image time that will deploy all settings (keychains, eap plist, airport plist, etc) in order to have a machine authenticate to AD and RADIUS at the login window and get onto our wireless network. Right now, we have everyone making a user profile. Ideally, I want to be able to send out a package either through InstaDMG or our Casper server (software management system). That way, nobody has to create their own profile and we can set up a machine when we image it to let the user just log in and be on our wireless lan. It seems that 10.4 had NetworkAuthConfigList in the loginwindow but I can't figure out how 10.5 exports these settings to the loginwindow. It's not within that plist. Does anyone have any ideas?

I'm attempting to create a package that I can install at image time that will deploy all settings (keychains, eap plist, airport plist, etc) in order to have a machine authenticate to AD and RADIUS at the login window and get onto our wireless network. Right now, we have everyone making a user profile. Ideally, I want to be able to send out a package either through InstaDMG or our Casper server (software management system). That way, nobody has to create their own profile and we can set up a machine when we image it to let the user just log in and be on our wireless lan. It seems that 10.4 had NetworkAuthConfigList in the loginwindow but I can't figure out how 10.5 exports these settings to the loginwindow. It's not within that plist. Does anyone have any ideas?

EP Performance Tunning and concurrent user login problems

Hi all.
We have a EP , integrated with Windows AD and SAP R3.
In real situation, there will be 1000 users login in EP in 0.5 hours. And their operation time will be 6-8 hours, connect to R3 or other applications.
Is EP can support such concurrent user login scenario ?
if EP fails, is there some performance monitor tool or performance tunning issue ?

Hi
EP supports this logon load, however it all depends on sizing and architecture! Also the content of the STARTPAGE can be critical (make it "light").
If the portal fails, then often it is only one J2EE server process, which fails - so by having more server-processes will be an easy/minimum form of high availability. A "real" HA solution must be considered if your business will not work without the portal og SAPGUI connections can be used as workaround/fallback in such situations.
BR
Tom Bo

Limit concurrent user logins

Hi all,
One of our customers is trying to limit the number of concurrent user logins to 1.
He has deployed a 2500 WLC (v7.4) with a Dot1x SSID. Authentication against external radius server (IAS).
Configured the following:
Max Concurrent Logins for a user name: 1
But doesn't work despite of the value configured in "Max-Login Ignore Identity Response" option (enable|disable).
My doubt here is if that these parameters just work when we are using local authentication or if it could be a bug with this particular software train.
I've found contradictory info regarding this particular topic.
Thanks in advance.
Best regards,
Alberto

Hi Saurav,
Thanks for the info provided.
Our problem here is that despite the value of max-login-ignore-identity-response (enable|disable) we always can establish multiple simultaneous connections with the same username credentials.
Does Max Concurrent Logins for a user name work with external radius authentication? Are we missing something else?
Thanks in advance.
Best regards,
Alberto

Wireless Phone 7925 authentication with Windows NPS

Hello,
I try to enable Authentication on our Wireless phone 7925 that are connected on WLC.
Can I use Windows NPS?
I try to use it without success, phones are not able to authenticate.
Someone can help me?
Thanks a lot!
Seb

Same thing for 2003, it is called IAS (Internet Authentication Service).
http://www.microsoft.com/technet/network/ias/default.mspx
Basically you will set up IAS with a RADIUS Client which would be your wireless access point(s). Then you will set up a remote access policy which will define how connections are authorized or rejected (windows groups, protocols etc.). Don't forget to register IAS with active directory.

Login window crash

With my very limited experience I am trying to solve a problem in OSX 10.4 server. Any suggestions are greatly appreciated.
This system serves user data via open directory to several users. The services are working fine but I cannot login to the console. After rebooting the "Starting Mac OSX Server" window appears (takes a long time to show up though) and the bar progresses to the end but it gets stuck there and the login window never shows up.
I can ssh into the system and looking at the system.log I see the loginwindow is crashing:
Apr 10 03:15:59 cysteine crashdump[3548]: loginwindow crashed
Apr 10 03:15:59 cysteine launchd: /System/Library/CoreServices/loginwindow.app/Contents/MacOS/loginwindow port /dev/console exited abnormally: Trace/BPT trap
Apr 10 03:15:59 cysteine crashdump[3548]: crash report written to: /Library/Logs/CrashReporter/loginwindow.crash.log
Apr 10 03:15:59 cysteine crashdump[3550]: loginwindow crashed
The logwindow.crash.log shows:
Host Name: Cysteine
Date/Time: 2009-04-10 12:51:08.087 -0700
OS Version: 10.4.11 (Build 8S169)
Report Version: 4
Command: loginwindow
Path: /System/Library/CoreServices/loginwindow.app/Contents/MacOS/loginwindow
Parent: launchd [1]
Version: 4.7 (4.7)
PID: 7071
Thread: Unknown
Link (dyld) error:
Library not loaded: /System/Library/PrivateFrameworks/AFPDefines.framework/Versions/A/AFPDefines
Referenced from: /System/Library/CoreServices/loginwindow.app/Contents/MacOS/loginwindow
Reason: no suitable image found. Did find:
/System/Library/PrivateFrameworks/AFPDefines.framework/Versions/A/AFPDefines: unknown file type, first eight bytes: 0x4F 0x63 0x74 0x2F 0x32 0x30 0x30 0x38
I then looked at the AFPDefines file type, which turned out to be text. However, in my non-server Mac running Tiger this file is is a "Mach-O dynamically linked shared library ppc"
Tried Googling AFPDefine and related searches but cannot figure our what this is. I also went back to the OSX server install disk but the AFPDefines.framework does not exist there....
ANY HELP woudl be greatly appreciated.
M

Hi, I have the same problem. Looking at all postings here, looks like this is a common problem with us all using 10.4.11 update.
My problem is 2-fold. Since this problem started after latest update to 10.4.11, I'm also unable to boot the system with MacOS X 10.4 installation disk. However, funny and interestingly, I can boot this PPC machine with my other Mac OS X 10.5 installation disks that I have for my newer mac. But, of course, I could only use disk utilities to repair the disk. Alas, this is not a disk problem. Somehow, the new system update has corrupted the AFPDefines file. The only thing needed is the AFPDefines file.
I looked up the under Developer SDKs and found a few versions of the AFPDefines. However none of them worked. I tried them all. You can try it and if you find it working let us all know.
If some how we can find a user of this forum that hasn't yet updated their 10.4 system to the latest 10.4.11, maybe we can ask them to post their not-yet-corrupted AFPDefines file here so we can all use it to repair our systems login process back to normal again.
Last resort is to ask Apple to give our AFPDefines files back
Any suggestions?

When i login to update my existing apps, the login window shows the wrong apple id. and it's all prayed out, i can't change it. how do i solve this problem?

When I login to update my existing apps, the login window shows the wrong apple id. i cannot change it because it is all grayed out. how do i solve this problem?

Content and Apple IDs -
Content is forever tied to the Apple ID that bought it. Apple does not transfer content from one Apple ID to another. Apple does not merge Apple IDs. You will never be able to access your content bought with one Apple ID with a new Apple ID.

10.4.8 Client takes long time to get to login window when bound to OD.

I am working on a system in a school. We have a dual processor g5 xserve with 4 gb of ram, the raid card, and 3 500 gb drives.
Fresh install of 10.4.8 with all the updates.
Raid 5 split in 2 volumes, one for server and one for data.
AFP service running.
Local dns running.
Promoted to open directory master.
This is the following test scenario i have.
there is a user called studenttest and he belongs to a group called cccarstarmembers and is in a workgroup called student.
the studenttest users home folder exists in a sharepoint called students that is set up on the data partition.
there is a sharepoint called cccarstar that holds data for some educational software we use. The owner is administrator with rw access, the group is cccarstarmembers with rw access and others have no access.
The student workgroup only has a few changes like dock location just for testing purposes to verify that the work group is working properly.
When i bind a newly built 10.4.8 client with all the updates to the od server it intermittantly takes a long time for the client to get to the login window when it is powered up. Sometimes it will get to the login window in 45 seconds and other times it will take 5 minutes. This is not consistant. if you unbind the client then the computer will behave properly consistantly.
I have tried binding the client to the od master using the fully qualified domain name and the ip address with the same results.
the search path on the server is "dc=osx1,dc=erm,dc=sd,dc=bc,dc=ca" and on the client it auto populates at cn=config,dc=osx1,dc=erm,dc=sd,dc=bc,dc=ca".
I have changed the search path on the client to match the search path on the server with no success as this is what used to work for us on panther setups.
But this school has a panther client i am working on at the same time with the same applications installed and system preference settings and when i bind it to the same od master with the same search path that is displayed on the server it works fine. all users work, all groups and work groups work.
Dns appears to be working. lookup provides the correct forward and reverse lookup info on the server, if i use either the panther or tiger client and use lookup with the servers fully qualified domain name and ip address i get the correct answers back.
I had this problem before where tiger gave me slow to login screen problems but panther wouldnt when bound, and apple told me that it was because i had afp guest access disabled on the server. Enabling it resolved the issue about 6 months ago at another site but this time when building the server i made sure it was on from the start even thoug it is off by default.
Any suggestions, i am pulling my hair out and about 8 working hours from a deadline.

I've seen this a lot.
This Knowledge Base article refers to Active Directory but we've seen this fix login delays with OD-only environments too:
http://docs.info.apple.com/article.html?artnum=303841
Another one of the causes is when you have multiple network mounts and your AFP service has guest access disabled. The loginwindow is trying to authenticate to each share with the username given and it is failing when that user account is not authorised for that share.
Another can be the LDAP timeout value(s). Try adjusting these in the LDAPv3 plug-in.
Also make sure your network ports have portfast/faststart set on the Mac ports. Sometimes because of STP the port isn't initialised fast enough for the OS when it's ready to start LDAP'ing.
Let me know if any of this helps.

Limiting Concurrent RADIUS Logins - Windows NPS or Aerohive

Similar Messages

Maybe you are looking for