PEAP Auth with Cisco ACS 5.3 and Lotus Notes DB

[acontes]

Hi,

i want to authenticate wireless clients against username/passwords stored in a lotus notes database.

Network: PEAP SSID->Accesspoint->4404 WLAN Controller->ACS 5.3->Notes DB

Is this possible?

I can connect to the ldap and query groups and attributes. but when i try to authenticate a user, i allways get an "subject not found in identity store" error.

Test bind was successfull (found >100 groups and >100 subjects.

[maldehne]

Are you using EAP MSCHAP v2 ??

[acontes]

Yes, i use EAP MSChapV2.

In the meantime, i sniffed the lan port of ACS. There is no outgoing bind request when i try to authenticate a wireless user.

The Indentity rule under my access service works fine. The hit counter on the rule "use the ldap db" identity store is increasing. but no authorization rule matches.

[acontes]

Ah thanks for the hint :-)

Looks like i should use EAP-GTC to work with Lotus LDAP, correct? How can i change this? Clientside, Phase-2 Auth Type?

Doh! Running into the next problem: Android works because i can select GTC, in Apple iOS not.

[maldehne · Accepted solution]

EAP MSCHAP v2 is not supported with LDAP through ACS

You can use EAP GTC

You should a supplicant utility that supports PEAP ( EAP GTC )

such as Cisco ADU , Intel Proset , CSSC , AnyConnect , ...... you can google for a list of supplicants

open new thread for Apple issue

------------------------------------------------------------------

Please make sure to rate correct answers and flag this thread as answered