{"id":6151,"date":"2022-09-09T08:07:09","date_gmt":"2022-09-09T08:07:09","guid":{"rendered":"https:\/\/pariswells.com\/blog\/?p=6151"},"modified":"2022-09-09T08:07:09","modified_gmt":"2022-09-09T08:07:09","slug":"workaround-for-wildcard-in-radius-wifi-setup","status":"publish","type":"post","link":"https:\/\/pariswells.com\/blog\/research\/workaround-for-wildcard-in-radius-wifi-setup","title":{"rendered":"Workaround for Wildcard in Radius Wifi Setup"},"content":{"rendered":"<p>&nbsp;<\/p><p class=\"x_MsoNormal\">\u00a0<\/p><ul type=\"disc\"><li class=\"x_MsoListParagraph\">Staff unable to connect to a new SSID.<\/li><li class=\"x_MsoListParagraph\">Authenticators report an \u2018access-reject\u2019 being returned from the NPS\/RADIUS server.<\/li><li class=\"x_MsoListParagraph\">NPS rejecting with reason code 16 (Bad username\/password)<\/li><li class=\"x_MsoListParagraph\">You see NPS logs where you have an auth type of \u201cPEAP\u201d but the \u201cEAP Type\u201d is null \/ \u201c-\u201c<\/li><\/ul><p class=\"x_MsoNormal\" aria-hidden=\"true\">\u00a0<\/p><p><img loading=\"lazy\" decoding=\"async\" width=\"1290\" height=\"317\" class=\"alignnone size-full wp-image-6155  img-responsive\" src=\"http:\/\/pariswells.com\/blog\/wp-content\/uploads\/2022\/09\/img_631af396b2d44.png\" alt=\"\" srcset=\"https:\/\/pariswells.com\/blog\/wp-content\/uploads\/2022\/09\/img_631af396b2d44.png 1290w, https:\/\/pariswells.com\/blog\/wp-content\/uploads\/2022\/09\/img_631af396b2d44-300x74.png 300w, https:\/\/pariswells.com\/blog\/wp-content\/uploads\/2022\/09\/img_631af396b2d44-1024x252.png 1024w, https:\/\/pariswells.com\/blog\/wp-content\/uploads\/2022\/09\/img_631af396b2d44-768x189.png 768w\" sizes=\"auto, (max-width: 1290px) 100vw, 1290px\" \/><\/p><p class=\"x_MsoNormal\" aria-hidden=\"true\">\u00a0<\/p><p class=\"x_MsoNormal\">General background: dot1x\/AD authentication for network connections can use either EAP or PEAP. EAP requires a valid certificate on the access point as well as on the NPS\/RADIUS server. PEAP is transparent and you only need a valid certificate on the RADIUS\/NPS server. By Valid \u2013 I mean trusted by the client; it does not need to explicitly be a public ca.<\/p><p class=\"x_MsoNormal\" aria-hidden=\"true\">\u00a0<\/p><p class=\"x_MsoNormal\">Cause:<\/p><ul type=\"disc\"><li class=\"x_MsoListParagraph\">NPS Server is configured to serve a certificate with a wildcard in the subject \u201c*.yarracm.com\u201d as an example.<\/li><\/ul><p id=\"ikVgBop\"><img loading=\"lazy\" decoding=\"async\" width=\"1068\" height=\"617\" class=\"alignnone size-full wp-image-6157  img-responsive\" src=\"http:\/\/pariswells.com\/blog\/wp-content\/uploads\/2022\/09\/img_631af3ed3c3b2.png\" alt=\"\" srcset=\"https:\/\/pariswells.com\/blog\/wp-content\/uploads\/2022\/09\/img_631af3ed3c3b2.png 1068w, https:\/\/pariswells.com\/blog\/wp-content\/uploads\/2022\/09\/img_631af3ed3c3b2-300x173.png 300w, https:\/\/pariswells.com\/blog\/wp-content\/uploads\/2022\/09\/img_631af3ed3c3b2-1024x592.png 1024w, https:\/\/pariswells.com\/blog\/wp-content\/uploads\/2022\/09\/img_631af3ed3c3b2-768x444.png 768w\" sizes=\"auto, (max-width: 1068px) 100vw, 1068px\" \/><\/p><p class=\"x_MsoListParagraph\" aria-hidden=\"true\">\u00a0<\/p><ul type=\"disc\"><li class=\"x_MsoListParagraph\">The original SSID has \u201cdo not validate ssl certificate\u201d<\/li><\/ul><p><img loading=\"lazy\" decoding=\"async\" width=\"805\" height=\"357\" class=\"alignnone size-full wp-image-6154  img-responsive\" src=\"http:\/\/pariswells.com\/blog\/wp-content\/uploads\/2022\/09\/img_631af3963cc0f.png\" alt=\"\" srcset=\"https:\/\/pariswells.com\/blog\/wp-content\/uploads\/2022\/09\/img_631af3963cc0f.png 805w, https:\/\/pariswells.com\/blog\/wp-content\/uploads\/2022\/09\/img_631af3963cc0f-300x133.png 300w, https:\/\/pariswells.com\/blog\/wp-content\/uploads\/2022\/09\/img_631af3963cc0f-768x341.png 768w\" sizes=\"auto, (max-width: 805px) 100vw, 805px\" \/><\/p><p class=\"x_MsoListParagraph\" aria-hidden=\"true\">\u00a0<\/p><p class=\"x_MsoNormal\" aria-hidden=\"true\">\u00a0<\/p><p class=\"x_MsoNormal\">So in the new SSID the client is sent a certificate which has an invalid name, this invalid name. Because the certificate isn\u2019t trusted it then doesn\u2019t send the MSCHAPv2 credentials so you essentially are trying to login with a username but no password.<\/p><p class=\"x_MsoNormal\" aria-hidden=\"true\">\u00a0<\/p>","protected":false},"excerpt":{"rendered":"<p>&nbsp;\u00a0Staff unable to connect to a new SSID.Authenticators report an \u2018access-reject\u2019 being returned from the NPS\/RADIUS server.NPS rejecting with reason code 16 (Bad username\/password)You see NPS logs [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[3974,3976,3975,2782,2551,2481],"class_list":["post-6151","post","type-post","status-publish","format-standard","hentry","category-research","tag-authentication-failed-due-to-user-credentials-mistmatch","tag-either-the-user-name-provided-does-not-map","tag-peap","tag-radius","tag-wifi","tag-wildcard"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/posts\/6151","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/comments?post=6151"}],"version-history":[{"count":1,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/posts\/6151\/revisions"}],"predecessor-version":[{"id":6158,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/posts\/6151\/revisions\/6158"}],"wp:attachment":[{"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/media?parent=6151"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/categories?post=6151"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/tags?post=6151"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}