EAP-FAST User Changeable Passwords with Active Directory

[cmetzger]

Having an issue with getting expired password to sucessfully change when doing EAP-FAST authentication.

Setup in my lab is Win XP, 350 card, 1231AP, 6503-WLSM, ACS 3.3, authenticating to Active Directory.

Authentication works great, fast roaming works fine, but when I expire a password I get the change password screen, but after I entere the old/new password I get "Password change failed."

I've got the ACS box setup as it says in the Docs with the Cisco computer, and the ciscoacs user, etc... I've scoured the docs, and Internet, but not much out there.

I've banging my head against the wall on this one? Anyone have this working? Is there something more I need to do on the AD side?

[umedryk]

What is the exact error message you get ?

[cmetzger]

The failure message is pretty generic. "Password change failed. Contact your administrator."

[cmetzger]

FYI-The problem turned out to be with our active directory config.

With a clean AD install in the lab it works like a charm.