krax13

There is a Novell LDAP directory what contains all workers. But the structure is a bit complicated. There are several OUs in the same LDAP directory, so I had to add each OUs to the sites-available/ldap configuration. I have tested with ldapsearch and the radtest, and the users were found, so it works well. However It seems to be solved the iOS16 issue. I created a new .mobileconfig with the WPA2-enterprise network and I have added the server cert and attached to it. Now it started to work... If I add public cert to radius server, the client will trust it automatically or I need to add manually to the client as well?

Yeah, I know... It is one of my client who cannot migrate the old Novell structure to MS AD now... But the authentication with O365 user is not work as well. The connection between radius and O365 LDAP is implemented with PAP not MSCHAPV2. They had to choose EAP-TTLS (PAP) due to Novell eDir...

Hi all, I have been facing this problem with iOS 16.0.2 as well. Some Novell eDirectories and one O365 AD were registered in ldap settings and using WPA2 EAP-TTLS connection with self-signed certificate. We are using Freeradius 3.0.21 on openSUSE Leap 15.3. In the radius log, I can see some unfinished EAP sessions: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !! EAP session with state 0x7f352f727f363ab6a457a9fad0de3e3d did not finish! !! !! Please read http://wiki.freeradius.org/guide/Certificate_Compatibility !! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! When the client tried to connect with/without certificate, the User-Password attribute wasn't sent. (3062) Found Auth-Type = ldap-ksze (3062) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (3062) Auth-Type ldap-ksze { (3062) ksze: WARNING: You have set "Auth-Type := LDAP" somewhere (3062) ksze: WARNING: ********************************************* (3062) ksze: WARNING: * THAT CONFIGURATION IS WRONG. DELETE IT. (3062) ksze: WARNING: * YOU ARE PREVENTING THE SERVER FROM WORKING (3062) ksze: WARNING: ********************************************* (3062) ksze: ERROR: Attribute "User-Password" is required for authentication (3062) [ksze] = invalid (3062) } # Auth-Type ldap-ksze = invalid (3062) Failed to authenticate the user (3062) Using Post-Auth-Type Reject (3062) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (3062) Post-Auth-Type REJECT { (3062) attr_filter.access_reject: EXPAND %{User-Name} (3062) attr_filter.access_reject: --> maupet (3062) attr_filter.access_reject: Matched entry DEFAULT at line 11 (3062) [attr_filter.access_reject] = updated (3062) update outer.session-state { (3062) &Module-Failure-Message := &request:Module-Failure-Message -> 'ksze: Attribute "User-Password" is required for authentication' (3062) } # update outer.session-state = noop (3062) } # Post-Auth-Type REJECT = updated (3062) Login incorrect (ksze: Attribute "User-Password" is required for authentication): [maupet/] (from client WLC port 8 cli 76-08-32-d8-e4-9e via TLS tunnel) (3062) } # server inner-tunnel (3062) Virtual server sending reply (3062) eap_ttls: Got tunneled Access-Reject (3062) eap: ERROR: Failed continuing EAP TTLS (21) session. EAP sub-module failed (3062) eap: Sending EAP Failure (code 4) ID 10 length 4 (3062) eap: Failed in EAP select (3062) [eap] = invalid (3062) } # Auth-Type eap = invalid (3062) Failed to authenticate the user (3062) Using Post-Auth-Type Reject (3062) Post-Auth-Type sub-section not found. Ignoring. (3062) Login incorrect (eap: Failed continuing EAP TTLS (21) session. EAP sub-module failed): [maupet/] (from client WLC port 8 cli 76-08-32-d8-e4-9e) (3062) Delaying response for 1.000000 seconds Waking up in 0.1 seconds. Waking up in 0.7 seconds. (3062) Sending delayed response (3062) Sent Access-Reject Id 30 from 193.225.81.36:1812 to 10.63.128.3:41419 length 44 (3062) EAP-Message = 0x040a0004 (3062) Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 5.7 seconds. (3057) Cleaning up request packet ID 25 with timestamp +416818 (3058) Cleaning up request packet ID 26 with timestamp +416818 (3059) Cleaning up request packet ID 27 with timestamp +416818 (3060) Cleaning up request packet ID 28 with timestamp +416818 (3061) Cleaning up request packet ID 29 with timestamp +416818 Waking up in 0.1 seconds. (3062) Cleaning up request packet ID 30 with timestamp +416818 Ready to process requests It's only on iOS 16, no issues below this and neither with Android and Windows clients.