<br><font size=2 face="sans-serif">Hello everyone !</font>
<br>
<br><font size=2 face="sans-serif">I'm having a hard time figuring out
why my wireless client is not getting information concerning a password
that needs to be changed (either because it's expired, or first time login).</font>
<br>
<br><font size=2 face="sans-serif">I get this warning for a first time
login :</font>
<br>
<br><font size=2 face="sans-serif">Wed Apr 2 17:05:40 2008: WARNING:
Could not LogonUserNetworkMSCHAP (V2): 3221226020, 0, The user's password
must be changed before logging on the first time.</font>
<br><font size=2 face="sans-serif">Wed Apr 2 17:05:40 2008: DEBUG:
EAP result: 1, EAP MSCHAP-V2 Authentication failure</font>
<br><font size=2 face="sans-serif">Wed Apr 2 17:05:40 2008: DEBUG:
AuthBy LSA result: REJECT, EAP MSCHAP-V2 Authentication failure</font>
<br>
<br><font size=2 face="sans-serif">And I get this warning for a password
that is expired :</font>
<br>
<br><font size=2 face="sans-serif">Mon Mar 31 09:04:39 2008: WARNING: Could
not LogonUserNetworkMSCHAP (V2): 3221225582, 3221225585, Logon failure:
the specified account password has expired.</font>
<br><font size=2 face="sans-serif">Mon Mar 31 09:04:39 2008: DEBUG: Radius::AuthLSA
REJECT: AuthBy LSA Password check failed: DOM\username [DOM\username]</font>
<br><font size=2 face="sans-serif">Mon Mar 31 09:04:39 2008: DEBUG: AuthBy
LSA result: REJECT, AuthBy LSA Password check failed</font>
<br>
<br><font size=2 face="sans-serif">I'm talking LSA to my Active Directory
server (win2K3)</font>
<br><font size=2 face="sans-serif">And the client is Juniper Odyssey (funk)
setup for WPA2/PEAP/MS-CHAP-V2.</font>
<br>
<br><font size=2 face="sans-serif">Everything works fine, unless those
two situations occur.</font>
<br><font size=2 face="sans-serif">What am I missing ?</font>
<br>
<br>
<br><font size=2 face="sans-serif">Config file (this is a test file) :</font>
<br>
<br><font size=2 face="sans-serif"><Handler TunnelledByPEAP=1></font>
<br><font size=2 face="sans-serif"> #
Authenticate with Windows LSA</font>
<br><font size=2 face="sans-serif"> <AuthBy
LSA></font>
<br><font size=2 face="sans-serif">
DefaultDomain DOM</font>
<br><font size=2 face="sans-serif">
EAPType MSCHAP-V2</font>
<br><font size=2 face="sans-serif"> </AuthBy></font>
<br><font size=2 face="sans-serif"></Handler></font>
<br>
<br><font size=2 face="sans-serif"><Handler></font>
<br><font size=2 face="sans-serif"> <AuthBy
FILE></font>
<br><font size=2 face="sans-serif">
EAPType PEAP</font>
<br><font size=2 face="sans-serif">
EAPTLS_CAFile %D/certificates/demoCA/cacert.pem</font>
<br><font size=2 face="sans-serif">
EAPTLS_CertificateFile %D/certificates/cert-srv.pem</font>
<br><font size=2 face="sans-serif">
EAPTLS_CertificateType PEM</font>
<br><font size=2 face="sans-serif">
EAPTLS_PrivateKeyFile %D/certificates/cert-srv.pem</font>
<br><font size=2 face="sans-serif">
EAPTLS_PrivateKeyPassword whatever</font>
<br><font size=2 face="sans-serif">
EAPTLS_MaxFragmentSize 1000</font>
<br><font size=2 face="sans-serif">
AutoMPPEKeys</font>
<br><font size=2 face="sans-serif">
EAPTLS_PEAPVersion 0</font>
<br><font size=2 face="sans-serif"> </AuthBy></font>
<br><font size=2 face="sans-serif"></Handler></font>
<br>
<br>
<br><font size=2 face="sans-serif">Thanks for the help !</font>
<br>
<br><font size=2 face="sans-serif"><br>
Martin Bérubé<br>
Architecture et Sécurité des Réseaux<br>
Network Infrastructure and Security<br>
<br>
Centre d'Information Rx Ltée / Rx Information Center Ltd<br>
Groupe Jean Coutu (PJC) Inc.<br>
2165 de la Province,<br>
Longueuil, Qc (Canada) J4G 1Y6<br>
<br>
Tél./Tel. : (450) 463-1890 x3362<br>
(888)
463-1890 x3362<br>
<br>
Courriel/e-mail : mberube@jeancoutu.com</font>
<table><tr><td bgcolor=#ffffff><font color=#000000><pre>AVERTISSEMENT CONCERNANT LA CONFIDENTIALITE
Ce message, incluant ses pieces jointes, est strictement reserve a l'usage de l'individu ou de l'entite a qui il est
adresse et contient de l'information privilegiee et confidentielle. La dissemination, distribution ou copie de cette
communication est strictement prohibee. Si vous n'etes pas le destinataire projete veuillez retourner
immediatement un courrier electronique a l'expediteur et effacez toutes les copies.
CONFIDENTIALITY WARNING
This message, including its attachments, is strictly intended for the use of the individual or the entity to which it is addressed
and contains privileged and confidential information. Disclosure, distribution or copy of this communication is strictly
prohibited. If you are not the intended recipient please notify us immediately by returning the e-mail to the originator and
deleting all copies.</pre></font></td></tr></table>