PEAP will not work

[Lczap]

Hi! I just cannot get PEAP-EAP-MSCHAPv2 working. Not from code, not even from the jradius simulator. The server rejects the access request, apparently the inner protocol is not recognized by the server (the server configuration is definitely correct, other clients can successfully authenticate with this method). Can anyone share a code snippet or a jradius simulator configuration that works with PEAP? It would be appreciated. I can share more details of my attempts if needed. Thanks.

[TofCollet]

Hello,

I'm facing the same issue when trying to connect to a freeRadius server with PEAP authenticator.
I have compared freeRadius logs with a request from jradius and another (successfull) from eapol_test.
The changes appear when decoding the tunneled attributes:

With jradius:
+group authenticate {
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] eaptls_verify returned 7
[peap] Done initial handshake
[peap] eaptls_process returned 7
[peap] EAPTLS_OK
[peap] Session established. Decoding tunneled attributes.
[peap] Peap state ?
[peap] Identity - anonymous
[peap] Unhandled state in peap
[eap] Handler failed in EAP/peap
[eap] Failed in EAP select
++[eap] = invalid
+} # group authenticate = invalid

With eapol_test:
+group authenticate {
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] Received TLS ACK
[peap] ACK handshake is finished
[peap] eaptls_verify returned 3
[peap] eaptls_process returned 3
[peap] EAPTLS_SUCCESS
[peap] Session established. Decoding tunneled attributes.
[peap] Peap state TUNNEL ESTABLISHED
++[eap] = handled
+} # group authenticate = handled

Any clue on why the State Attribute is not correct ?

Thanks

[necouchman]

FWIW I'm having the exact same issue. I've got pretty much every other protocol to work correctly in my use of the JRadius code, but PEAP exhibits very similar error messages to what others have already posted - the "Peap State ?" message. Any clues?

[necouchman]

Behavior appears identical on the JRadius Simulator:

(10) eap_peap : processing EAP-TLS
(10) eap_peap : eaptls_verify returned 7
(10) eap_peap : Done initial handshake
(10) eap_peap : eaptls_process returned 7
(10) eap_peap : FR_TLS_OK
(10) eap_peap : Session established. Decoding tunneled attributes
(10) eap_peap : Peap state ?
(10) eap_peap : Identity - Andy_Taylor
(10) eap_peap : Unhandled state in peap SSL: Removing session f46cc45a457733edc89d0dc3d8b0b2f36f32e242953982b5611ba0c8d51ce0f1 from the cache
(10) ERROR: eap : Failed continuing EAP PEAP (25) session. EAP sub-module failed

[TofCollet]

Hi, i solved m'y problem by using a previous version of jradius. There must have been some changes that made peap not working anymore...

[necouchman]

Do you know which version worked? I'd like to go back through and look for the regression and see if I can pinpoint where that happened. Be nice to have that fixed.

[TofCollet]

It worked with version 1.1.4 and not with 1.1.5.

[necouchman]

Thanks. I briefly looked through the commit history and see a few changes to PEAP specifically, but am not familiar enough with the code or RADIUS to figure out where the regression is that is stopping the PEAP tunnel from being established. Maybe at some point soon I can get some logging turned on for the class and figure out exactly where it's stopping.

[jm-k]

This branch (forked from 1.1.5) should correct the problem : https://github.com/jm-k/jradius/tree/Issue-peap
Submitted a PR : #21

[dineshkumar016]

@jm-k I have implemented JRadius with freeradius to provide user data from tomcat server. all protocol such as PAP, MSCHAPV2 works, but EAP_TTLS doesnot work found out the issue is while create session in "getRequestSessionKey" in RadiusSessionKeyProvider because of absence NAS-IP-Address during inner tunnel communication , but from request we can only FreeRADIUS-Proxied-To, may i know if you have any idea on this?