RE: IAS authorization against AD groups without authentication


I've come up with another problem. Each AAA request from the Cisco involves
two RADIUS interactions, one for authentication and one for what I assume is
authorisation.

When I send through a RADIUS-REQUEST for authentication and pass a valid
username and password, IAS finds the account object, authenticates me and
gives me RADIUS-ACCEPT.

When I send the same username string through for authorisation the IAS
server doesn't seem to find the account, it takes a guess and derives a
DOMAIN/ID format FQDN (which it gets correct) and then returns a
RADIUS-REJECT.

The only way I can successfully connect is to get the NAS to ignore the
authorisation stage.




"Niall Inglis" wrote:

Hi,

snip

.

Relevant Pages

  • Re: Forms Authentication behavior on request denial
    ... by Forms Authentication. ... You could then also get around your authorisation problem ... by explicitly redirecting authenticated, unauthorised ... >> You're seeing the expected behavior. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: authentication using custom UsernameTokenManager class.....
    ... authorisation has been completed but this has to be done from inside the web ... authorisation in a similar way to it does authentication? ... > check this against the web method that is being called..... ... > What I don't want to do is to use the UsernameTokenManager to do implicit ...
    (microsoft.public.dotnet.framework.webservices.enhancements)
  • Active Directory authentication / authorisation
    ... authentication / authorisation functionality in MS Access; ... The parameters used there are the LDAP parameters for AD: ...
    (comp.databases.ms-access)
  • RPC and Kerberos v5 ?
    ... I'm currently working on the design of an authorisation system. ... I need to use Kerberos v5 authentication. ... Or should I use sun-rpc with this gss stuf as defined in the rpc header files on solaris? ...
    (comp.unix.programmer)
Loading