<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.6000.16609" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT face=Arial size=2>The final part of my setup is to support EapTLS for
wireless. As I don't have yet an AP to test with I was using Lucents
VitalAAA radius client.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>The client gives me an error message: State
attribute is missing in Access-Challenge</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Is this a configuration error or an incompatible
client ?</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Thank you</FONT></DIV>
<DIV><FONT face=Arial size=2>Markus</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>P.S. Config extract is attached.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>VitalAAA client log:</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>2008/02/19 21:19:35.898 {AWT-EventQueue-0}
<tls.certandkeymanager> Installed ClientCert <A
href="mailto:EMAILADDRESS=markus.moeller@db.com">EMAILADDRESS=</A><A
href="">markus@moeller.plus.com</A>, CN=Test LAB, OU=Engineering, O=HOME
L=London, ST=London, C=GB as RSA<BR>2008/02/19 21:19:35.902 {AWT-EventQueue-0}
<tls.certandkeymanager> Installed ServerSet <A
href="mailto:EMAILADDRESS=markus.moeller@db.com">EMAILADDRESS=</A><A
href="">markus@moeller.plus.com</A>, CN=Test LAB, OU=Engineering, O=HOME
L=London, ST=London, C=GB as RSA<BR>2008/02/19 21:19:35.903 {AWT-EventQueue-0}
<tls.certandkeymanager> Installed ServerSet <A
href="mailto:EMAILADDRESS=markus.moeller@db.com">EMAILADDRESS=</A><A
href="">markus@moeller.plus.com</A>, CN=Test LAB, OU=Engineering, O=HOME
L=London, ST=London, C=GB as DHE_RSA<BR>2008/02/19 21:19:35.910
{AWT-EventQueue-0} <callback.eap.tls> Creating new client<BR>2008/02/19
21:19:35.916 {Radius Client Driver} <radiusClient> Xmit: Access-Request to
10.142.161.97:1812<BR> User-Name = "<A
href="">testuser@company.com</A>"<BR>
EAP-Message =
<BR> code =
Response<BR>
Identifier =
1<BR> Type =
Identity<BR>
Type-Data = "<A
href="">testuser@company.com</A>"<BR>
Message-Authenticator = "00000000000000000000000000000000"</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>2008/02/19 21:19:36.246 {Radius Client Listener
0.0.0.0:35536} <radiusClient> Recv: Access-Challenge after 336
ms.<BR> EAP-Message =
<BR> code =
Request<BR>
Identifier =
2<BR> Type =
TLS<BR>
Type-Data = " "<BR>
Message-Authenticator = "A0497AC4DB527F89BAA9F5353261293E"</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>2008/02/19 21:19:36.248 {Basic Callback}
<tls.protocolhandler> client/5 >>> Transmitting
ClientHello<BR>2008/02/19 21:19:36.248 {Basic Callback} <callback.eap.tls>
Enter nwkDataAvailable( ByteBuffer[] array )<BR>2008/02/19 21:19:36.249 {Basic
Callback} <callback.eap.tls> Sending a 0 byte message to the EAP TLS
client<BR>2008/02/19 21:19:36.249 {Basic Callback} <callback.eap.tls>
Received a 62 byte message from the EAP TLS client<BR>2008/02/19 21:19:36.249
{Basic Callback} <radiusclient.callback.challenge> (ERROR) State attribute
is missing in Access-Challenge<BR>2008/02/19 21:19:36.249 {Basic Callback}
<callback.eap.tls> Closing client </FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Radiator Trace output</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2></FONT><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>/usr/bin/radiusd -config_file
/etc/radiator/radius.cfg -log_stdout -trace 5 -foreground<BR>Tue Feb 19 20:58:05
2008: DEBUG: include /etc/radiator/readclients.pl|<BR>Tue Feb 19 20:58:05 2008:
NOTICE: Reading clients file /etc/radiator/clients<BR>Tue Feb 19 20:58:06 2008:
DEBUG: Creating TACACSPLUS port 0.0.0.0:49<BR>Tue Feb 19 20:58:06 2008: DEBUG:
Creating StreamServer tcp port 0.0.0.0:9443<BR>Tue Feb 19 20:58:06 2008: DEBUG:
Finished reading configuration file '/etc/radiator/radius.cfg'<BR>Tue Feb 19
20:58:06 2008: DEBUG: Reading dictionary file '/etc/radiator/dictionary'<BR>Tue
Feb 19 20:58:06 2008: DEBUG: Creating authentication port 0.0.0.0:1812<BR>Tue
Feb 19 20:58:06 2008: DEBUG: Creating accounting port 0.0.0.0:1813<BR>Tue Feb 19
20:58:06 2008: NOTICE: Server started: Radiator 4.0 on radius-server1<BR>Tue Feb
19 20:58:25 2008: DEBUG: Packet dump:<BR>*** Received from 10.128.55.23 port
35536 ....</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Packet length = 73<BR>01 00 00 49 60 b4 20 bb 38 51
d9 d4 7a cb 93 3d<BR>be 70 39 9b 01 0f 6d 6f 65 6c 6d 61 40 64 62 2e<BR>63 6f 6d
4f 14 02 01 00 12 01 6d 6f 65 6c 6d 61<BR>40 64 62 2e 63 6f 6d 50 12 10 f6 7b 50
45 19 e8<BR>7f c4 f2 d4 5c 51 28 7c
5b<BR>Code: Access-Request<BR>Identifier:
0<BR>Authentic: `<180>
<187>8Q<217><212>z<203><147>=<190>p9<155><BR>Attributes:<BR>
User-Name = "<A
href="mailto:testuser@company.com">testuser@company.com</A>"<BR>
EAP-Message = <2><1><0><18><1><A
href="">testuser@company.com</A><BR>
Message-Authenticator =
<16><246>{PE<25><232><127><196><242><212>\Q(|[</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Tue Feb 19 20:58:25 2008: DEBUG: PreHandlerHook
added LDAP Attributes:<BR>Tue Feb 19 20:58:25 2008: DEBUG: User-Mail = <A
href="mailto:markus@moeller.plus.com">markus@moeller.plus.com</A><BR>Tue Feb 19
20:58:25 2008: DEBUG: USER-PRINCIPAL-NAME = <A
href="">testuser@company.com</A><BR>Tue Feb 19 20:58:25 2008: DEBUG: Handling
request with Handler 'Device-Class=Wlan'<BR>Tue Feb 19 20:58:25 2008:
DEBUG: Deleting session for <A href="">testuser@company.com</A>,
192.168.100.1, <BR>Tue Feb 19 20:58:25 2008: DEBUG: Handling with
Radius::AuthFILE: EapTLS<BR>Tue Feb 19 20:58:25 2008: DEBUG: Handling with EAP:
code 2, 1, 18, 1<BR>Tue Feb 19 20:58:25 2008: DEBUG: Response type 1<BR>Tue Feb
19 20:58:25 2008: DEBUG: EAP result: 3, EAP TLS Challenge<BR>Tue Feb 19 20:58:25
2008: DEBUG: AuthBy FILE result: CHALLENGE, EAP TLS Challenge<BR>Tue Feb 19
20:58:25 2008: DEBUG: Access challenged for <A href="">testuser@company.com</A>:
EAP TLS Challenge<BR>Tue Feb 19 20:58:25 2008: DEBUG: Packet dump:<BR>***
Sending to 10.128.55.23 port 35536 ....</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Packet length = 46<BR>0b 00 00 2e ee dd 2f 22 e4 0d
03 25 f6 81 56 5d<BR>d8 de 57 b1 4f 08 01 02 00 06 0d 20 50 12 a0 49<BR>7a c4 db
52 7f 89 ba a9 f5 35 32 61 29 3e<BR>Code:
Access-Challenge<BR>Identifier: 0<BR>Authentic: `<180>
<187>8Q<217><212>z<203><147>=<190>p9<155><BR>Attributes:<BR>
EAP-Message = <1><2><0><6><13>
<BR> Message-Authenticator =
<0><0><0><0><0><0><0><0><0><0><0><0><0><0><0><0></FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV></BODY></HTML>