custom authentication with ias extension dll problem

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

From: sanjaykumar (anonymous_at_discussions.microsoft.com)
Date: 02/26/04

  • Next message: Ashwin Palekar\(MS\): "Re: custom authentication with ias extension dll problem" 
    Date: Wed, 25 Feb 2004 18:11:06 -0800

    Hi,
    Basically i want to bypass ias standard authentication by windows accounts/ group/active directory etc and use my custom authentication criteria( say using checkSomeCondition() function below)
    I am writing ias extension dll for windows 2003 server IAS and using function RadiusExtensionInit and RadiusExtensionProcess.

    When I test extension DLL, i found it does not work as expected. It still refers to winodws accounts/groups for authenticating users.
    During debugging i observed that extension dll gets called and RADIUS_ACTION is set to raAccept if authentication criteria is met. but response received at radius client is "access reject".
    see the radius log file below with tracing enabled.I am expecting ias to send access accept response if *pfAction = raAccept is set to raAccept or access reject if *pfAction = raReject in ias extension dll.
    Does it requires some other settings/configuration in IAS configuration( what is that?) to achieve above functionality.

    In IAS My remote access policy is to grant access if authetication type matches CHAP , PAP or unauthenticated.

    i HAVE Enabled tracing for ias and following is content of tracing(iassam.log)

    2736] 02-26 05:48:11:984: NT-SAM Names handler received request with user identity test.
    [2736] 02-26 05:48:11:984: Prepending default domain.
    [2736] 02-26 05:48:11:984: NameMapper::prependDefaultDomain
    [2736] 02-26 05:48:11:984: SAM-Account-Name is "SUN\test".
    [2736] 02-26 05:48:11:984: Invoking ExtensionDLLs
    [2736] 02-26 05:48:11:984: Invoking extension HiWiFiIASExtension.dll
    [2736] 02-26 05:48:12:000: RadiusExtensionProcess returned 0
    [2736] 02-26 05:48:12:000: RADIUS_EXTENSION_CONTROL_BLOCK.SetResponseType(2)
    [2736] 02-26 05:48:12:000: Validating Windows account SUN\test.
    [2736] 02-26 05:48:12:000: Using downlevel APIs to validate account.
    [2736] 02-26 05:48:12:000: Using cached SAM connection to local account domain.
    [2736] 02-26 05:48:12:000: IASGetGroupsForUser failed: No mapping between account names and security IDs was done.

    Any suggestions or hints?

  • Next message: Ashwin Palekar\(MS\): "Re: custom authentication with ias extension dll problem"

    Relevant Pages

    • Re: 802.1x log off?
      ... windows does not send a log-off to IAS, but its 802.1x EAP state machine ... > I presumed that windows would send an EAP-logoff message to the IAS server ... > the IAS server using the 'xp balloon' on the bottom of the screen. ...
      (microsoft.public.internet.radius)
    • Re: IAS 2003 Connection Request Policies
      ... why should Microsoft IAS be so difficult? ... for Linux and Radiator for Windows) and they are very inexpensive. ... > not referred to as authentication since MAC address is public information ... > connect as a Windows guest account. ...
      (microsoft.public.internet.radius)
    • Re: IAS issues
      ... I was wondering if anyone has run into any issues with SP1 for windows ... Windows 2003 IAS ... "A LDAP connection with domain controller server.test.com for domain ... I asked the product team to review your problem and this is their response: ...
      (microsoft.public.internet.radius)
    • Re: Several policies on the same RADIUS
      ... As for group membership, you don't need an extension DLL to do this, it's ... > Hello I want to implement IAS as RADIUS for VPN access and much more... ... > I want to assign different permissions and I don't know how to accomplish> this task. ...
      (microsoft.public.internet.radius)
    • Re: Proxy IAS on Windows 2003
      ... Windows 2003 IAS has the ability to proxy and load balance. ... > Can I implement a Proxy radius on a Windows 2003> server, to connect IAS servers on Windows 2000 DCs on each> forest? ...
      (microsoft.public.internet.radius)