LAPAC1750 question - 2nd SSID authentication

Similar Questions

• Binding of the SSID authentication

  Hi friends,

  It is a query of wireless LAN design.

  Components used

  1 WLC Version 5.0

  2. 1142 cisco access points

  3 cisco ACS 1120

  4 authentication: 802.1 x WPA.

  I'm radio 2 SSID named (VLAN 10) HR & ADMIN (VLAN 20) in all points of access. Wireless clients Gets the IP address using the DHCP server.

  The issue I'm facing when person ADMIN Select HR ssid, it uses its useraname / password and connect to the network and human resources able to access the resource

  So, how to prevent the HR person uses his user name password to connect to the ssid ADMIN. The ultimate goal is, same HR employee selects ADMIN ssid, it should not get network access.

  Please help me by sharing your valuable ideas

  Kind regards

  Sairam

  Hi Sairam,

  In the Radius access request, the WLC is including the following attributes (among others):

  Called-Station-Id: this should come in the form of "(nom dele de mac: BSSID:SSID WLC)"
  Airespace-WLAN-Id: this is the index of the WLAN through which the user connects

  So you could build an authentication (or authorization) rule in ACS that verifies if the Radius Airespace-WLAN-Id attribute has the same index as the SSID ADMIN (or Called-Station-Id contains the string "ADMIN") and, if so, and if the user belongs to the HR group (defined in ACS or AD, for example), only not authentication (or approval).

  Hope this helps,

  Fede

  --
  If this helps you or answers to your question if it you please mark it as 'responded' or write it down, if other users can easily find it.

• Beginner question: 2nd hand pc, windows 7 compatible. You need to install windows 7 from scratch. Help

  I have a second hand diskless pc and I am wanting to put windows 7 on it. I'm also a complete beginner, where can I get help on this?

  Also, I have a copy of windows 7, can I use the code on the side of the pc?

  I have a second hand diskless pc and I am wanting to put windows 7 on it. I'm also a complete beginner, where can I get help on this?

  Also, I have a copy of windows 7, can I use the code on the side of the pc?

  You can't use the code on the side of the computer to activate your copy of Windows 7, it is no longer valid for the edition/version listed on the machine. Unless it's the same edition as you have on the disk.

  * 1 gigahertz (GHz) or faster 32-bit (x 86) or 64-bit (x 64) processor

  * 1 gigabyte (GB) of RAM (32-bit) or 2 GB RAM (64-bit)

  * 16 GB of disk space available (32-bit) or 20 GB (64-bit)

  * Peripheral figure DirectX 9 with WDDM 1.0 or higher driver

  Windows 7 system requirements
  http://Windows.Microsoft.com/en-us/Windows7/products/system-requirements

  ------------------------------------

  You can perform an installation without a Windows 7 key and see if it will work or attempt to reinstall the version of Windows that is listed on the certificate of authenticity.

  Boot from the Windows 7 DVD

  To learn how to change your BIOS options to boot from the DVD drive, the following tutorial:

  http://notebooks.com/2011/05/05/How-to-load-BIOS-and-change-boot-configuration/

  Click Install now

  Accept the license agreement

  When the option is displayed to select a type of installation, click (Custom advanced)

  Click on drive Options

  Select the disc/s click on Delete

  Click new

  Click on apply

  Click OK

  Click Format, and then click next to proceed with the installation

  Skip entering your product key Windows 7 and complete the installation.

  ----------------------

  Resources:

  Reinstall Windows XP:

  Install,reinstall, or uninstall Windows - help & How-to ...

  Reinstall Windows Vista: installation and relocation of Windows Vista

  Reinstall Windows 7:

  http://Windows.Microsoft.com/en-us/Windows7/installing-and-reinstalling-Windows-7

• A question about external authentication with PHP OCI8 using a portfolio store

  Hello
  

  SQL> SELECT * FROM v$version;
  
  BANNER
  --------------------------------------------------------------------------------
  Oracle Database 11g Enterprise Edition Release 11.2.0.1.0 - 64bit Production
  PL/SQL Release 11.2.0.1.0 - Production
  CORE     11.2.0.1.0     Production
  TNS for Linux: Version 11.2.0.1.0 - Production
  NLSRTL Version 11.2.0.1.0 - Production
  
  SQL> 

  OS: Linux Fedora Core 17 (x86_64)
  PHP Version: 5.4.14
  Apache version (httpd): Apache/2.2.23 (Fedora) 

  I have a question about OCI8 connection to the Oracle server via portfolio, which I understand is a good practice because we do not have to hard code the users password. I'm trying to read pages 117 and 118 of the book The Underground PHP and Oracle manual online to learn how to set up a portfolio. I proceeded by steps as explained in these two pages (except that at the end I connect, as a normal user, not a privileged user) yet, apparently PHP does not detect the user.
  
  Here's what I write in my script
  

  $connection = 
                  oci_connect 
                      (
                          "training", 
                          "", 
                          "php_ora_usr", 
                          "AL32UTF8"
                      );

  the training is the name of the user that I use in my PHP scripts to connect to the oracle database and the password is mypassword (is not true, just for the purpose of this thread :)) the code above gives me the following error:)

  Warning: oci_connect(): ORA-01005: null password given; logon denied in /var/www/html/myscript.php on line 91
  
  Fatal error: Connection step: ORA-01005: null password given; logon denied in /var/www/html/myscript.php on line 13

  But if I also provide the password which is,

  $connection = 
                  oci_connect 
                      (
                          "training", 
                          "mypassword", 
                          "php_ora_usr", 
                          "AL32UTF8"
                      );

  Obviously it works, but at the same time, this means that my wallet is not operational.
  
  So I'll write here, step by step, how I did according to the instructions contained in the pages 117 and 118 of the above mentioned book and I would be grateful if you could kindly tell where I made the mistake (s)
  
  The following text was performed under my oracle linux (so the dbagroup)
  
  Step 01:_
  I created and provided the password for the directory of portfolio

  mkstore -wrl /home/oracle/wallet_dir -create

  Step 02:_
  I created an entry for my oracle user that will be used in my PHP scripts to connect to oracle
  user: training
  password: mypassword

  mkstore -wrl "/home/oracle/wallet_dir" -createCredential php_ora_usr training mypassword

  I also checked that the entry was actually created for my user in the portfolio

  $ mkstore -wrl "/home/oracle/wallet_dir" -listCredential
  Oracle Secret Store Tool : Version 11.2.0.1.0 - Production
  Copyright (c) 2004, 2009, Oracle and/or its affiliates. All rights reserved.
  
  Enter wallet password:                
     
  List credential (index: connect_string username)
  1: php_ora_usr training
  $ 

  Step 03:_
  I added the following to my $TNS_ADMIN/tnsnames.ora

  .  .  .
  php_ora_usr = 
    (DESCRIPTION =
      (ADDRESS = (PROTOCOL = TCP)(HOST = localhost)(PORT = 1521))
      (CONNECT_DATA =
        (SERVER = DEDICATED)
        (SERVICE_NAME = db02)
      )
    )
  .  .  .

  Step 04_
  I added the following to my $TNS_ADMIN/sqlnet.ora

  # sqlnet.ora Network Configuration File: /u01/app/oracle/product/11.2.0/db_1/network/admin/sqlnet.ora
  # Generated by Oracle configuration tools.
  
  NAMES.DIRECTORY_PATH= (TNSNAMES, EZCONNECT)
  
  ADR_BASE = /u01/app/oracle
  
  WALLET_LOCATION =
      (SOURCE =
          (METHOD = FILE)
          (METHOD_DATA =
              (DIRECTORY = /home/oracle/wallet_dir)
          )
      )
  SQLNET.WALLET_OVERRIDE = TRUE
  SSL_CLIENT_AUTHENTICATION = FALSE
  SSL_VERSION = 0

  _ Step 05
  The TNS_ADMIN environment variable is already set correctly in * / etc/sysconfig/httpd * so I didn't need to do something for this step
  
  
  Step 06_
  I gave to access Apache (as root) in the directory of portfolio (in fact, it seems that the user oracle (dba) of linux also has the required privileges to grant this access to the apache)

  # setfacl -m u:apache:rx /home/oracle/wallet_dir
  # setfacl -m u:apache:r /home/oracle/wallet_dir/{cwallet.sso,ewallet.p12}

  Step 07_
  Restart Apache

  # service httpd restart

  Step 08_
  Finally make a test connection using the connection string php_ora_usr which the entry was created earlier. And the test was not successful, as indicated above

  $connection = 
                  oci_connect 
                      (
                          "training", 
                          "", 
                          "php_ora_usr", 
                          "AL32UTF8"
                      );

  The error message:
  

  Warning: oci_connect(): ORA-01005: null password given; logon denied in /var/www/html/myscript.php on line 91
  
  Fatal error: Connection step: ORA-01005: null password given; logon denied in /var/www/html/myscript.php on line 13

  I would appreciate it if you could kindly shed some light.
  
  Thanks in advance,
  Dariyoosh

  That gives a good clue to begin with. With your platform/Apache/DB, you might need different ACLs. Test directory and permissions. Check what euid your Apache runs as. Good luck.

• Questions during the authentication Mgmt Redirect challenge

  Hello
  
  I have configured the authentication form based with the following parameters of the challenge:
  
  Action:/access/Oblix/apps/WebGate/bin/WebGate.dll
  passthrough:no
  CREDS:userid password
  Form: / login.html
  
  When I tried to access the protected resource, I am being redirected to the page of connection successfully.
  
  Now I wish I had this login page called when the user tries to access a protected resource hosted in any other server/system. In other words, centralize this login page.
  
  I read that to allow it to need configure redirection of challenge.
  
  I have tried providing the following formats to redirect the challenge
  (a) http://Servername/login.html
  (b) http://Servername:80 / login.html
  
  but these don't work. Please tell me where I'm going wrong.
  
  Thank you

  Hey Joe,

  Takes the challenge to redirect as the name of the server, and it will add to the value that you put in the form: parameter. If the value of the redirection of challenge should just be:

  http://servername

  Kind regards
  Colin

• Question about authentication SDI on AnyConnct and ASA

  Hi all

  I would like to know about the flow of communication for the AnyConnect client authentication and ASA 5520 SDI.

  My client wants to use RSA SecurID On-Demand authenticator (token RSA SecurID On-Demand) between ASA 5520 for SSL VPN and AnyConnect client.

  I understand that ASA provides two modes to allow authentication SDI.

  Native SDI - ASA communicates directly with the SDI server to manage authentication SDI
  RADIUS SDI - ASA communicates to a RADUIS SDI (such as Cisco ACS) proxy and the proxy RADIUS SDI communicates with the SDI server, this means that the ASA does not communicate directly on the SDI server.

  I think that, in general (not consider ASA), the client (remote user) needs access to the web page on the server of the SDI for an SDI authentication token when it starts / SSL VPN connection configuration. However, I understand clearly that how SDI authentication works if I use ASA as secure gateway and configure ASA to allow authentication SDI.

  So my question is how authentication SDI work on ASA when I use ASA as secure gateway and configure ASA to allow authentication SDI (in both modes).

  The customer does not want the AnyConnect client to communicate with the server of SDI directly, but to communicate to ASA only because of their security problem. I don't know why the customer say...

  I found the following information of CEC.

  ==========
  When a remote user using authentication RADIUS SDI connects to the ASA with AnyConnect and attempts to authenticate using RSA SecurID token, the ASA communicates with the RADIUS server, which in turn, communicates with the SDI server for validation.
  ==========

  This means that the AnyConnect client does not communicate with the SDI server directly for authentication of SDI when it starts / SSL VPN connection configuration and the AnyConnect client must communicate with the SAA, because ASA communicates to the SDI server (instead of the AnyConnect client) as proxy?

  Your information would be appreciated.

  Best regards

  Shinichi

  Shinichi,

  I had a quick glance at the data sheet

  http://www.RSA.com/node.aspx?ID=3481

  I couldn't find the authentication of SMS as code ' on demand ', IE. RSA will communicate somehow with network cellular provider to deliver SMS with part user token. (Phone number should uniquely identify a user)

  Please note that it is a little suspicious if the device that you authenticate provide you authentication credentials :-)

  Unless you mean a scenario where users connect through ASA to request a token (be it via NAT or perhaps via SSL Portal?) anyway, ASA is usually unconscious because the user has their authentication from the two parties.

  Let me know if you meant different on the the request token. I'm curious to see what RSA has in store for us.

  Marcin

• Receive a message that Windows XP is no longer authentic.

  Office at a bad shot not repeat myself producted key received authentic microsoft software when I bought the pc do not how to reinstall

  continues to come screen not genuine microsoft how to reinstall with the product key code

  Hi darrenbray,

  1. What is the complete message you receive?
  2. Did you the latest changes on the computer?

  Check out the articles below to validate the copy of Windows and check if it helps.

  Windows Genuine Advantage does not validate a copy of Windows XP

  http://support.Microsoft.com/kb/916247

  Description of the Windows Genuine Advantage Notifications application

  http://support.Microsoft.com/kb/905474

  If you still have questions As f with validation Windows then I suggest that you post your question in the authentic Windows forum.

  http://social.Microsoft.com/forums/en-us/genuinewindowsxp/threads

• Aironet 1200 and MAC authentication

  Hi all

  I Aironet 1210 and you want to implement the authentication MAC without ACS.

  Now, I know that any AP Aironet can allow authentication MAC se store the list of MAC addresses.

  So after the command:

  TestAP (config-if-ssid) #authentication open mac

  TestAP (config-if-ssid) #authentication open mac address?

  WORD mac address list (1-31 characters) name

  There is no way I can list all MAC addresses in the list. I use IOS Version 12.2 (13) JA3.

  Any help would be greatly appreciated.

  Kind regards

  Samuel Wilson

  If you do not have a RADIUS server on your network, you can create a list of MAC addresses allowed on advanced security of access point: MAC address authentication page. Devices with not on the list of MAC addresses are not allowed to authenticate.

  I use the GUI to make a list:

  http://www.Cisco.com/en/us/products/HW/wireless/ps4570/products_configuration_example09186a00801c0912.shtml

  The link above is to use the local capacity of GANYMEDE to the AP, but if you select the option "Advanced Security" on the right side of the web interface, it will take you to the page where you can create your list of mac addresses.

  Please evaluate the useful messages.

• Based on rules of the ACS on Wireless SSID?

  As part of our policy BYOD, mobile phones are supposed to use only certificates for authentication, but they use MSCHAP and creds set caching to authenticate without a certificate. I think I can fix this in ACS by creating a rule that ALLOWS access if the user is using the x 509 cert and a rule that mobile DENYS access whether MSCHAP is used.

  I think it depends of ACS, be able to see users for particular SSID however. This is because we do not have another secure SSID and if I implement the above rules it would affect all looking wireless to auth.

  Does anyone know how to create political ACS from 5.2 the different SSID authentication?

  Josh,

  You can add a compound condition using the called-station-id RADIUS attribute, you use the operator "ends with" and then type in the SSID (case-sensitive), and you combine that with the method of authentication of x 509.

  Thank you

  Tarik Admani
  * Please note the useful messages *.

• AnyConnect & authentication digital certificate

  people

  I have a question about the authentication of users with digital certificates and name of user and password

  My ssl vpn works well but I have only one user so far

  my query is about how to manage certificates and additional users

  I'll add the users in the asa for local authentication but it is the certificates that I'm not sure

  can I use the same account in the certificate local user dbase, i.e. sslconnect and generate a new OTP for each user that I add to create the certificate or should I create a new account in the ACL user dbase for each user account that I create in AAA

  hope this isn't too complicated

  Thanks to anyone who takes the time to answer or read this

  greatly appreciated

  If you are authenticating using certificate, you must issue each user a different certificate for him/herself. The certificate is a unique certificate for each user. I would recommend that you have the user name as the certificate CN instead of a good "sslconnect" like CN, so you can distinguish different users.

  Hope that answers your question.

• WLC 4402 and authentication Web comments

  I've set up a WLAN guest who is using Web authentication to access the Internet. Layer 2 is open with broadcast SSID authentication. Guest users can connect to the LWAP, and when they try to open a web page, they are redirected to the Web Auth page automatically.

  The problem is that the redirect url contains the host name of the WLC and not the IP address of the virtual interface.

  https://hostname/login.

  As my DHCP server is distributing DNS servers for users invited on the Internet, the host name cannot be resolved and the page does not appear. If I replace the host name in the url with the virtual IP (1.1.1.1), the page appears correctly.

  The WLC is running version 6 software. Any suggestions?

  Well, the DNS must be able to resolve the name that you typed on the virtual interface configuration page.

  So it could be a name. This name is traore that the internal DNS should resolve so that he can go directly to the 1.1.1.1 page

  If you do not type anything in this box then it will not redirect as expected, or even if you type a different name which should be resolved by DNS, then it will fail in most of the time.

  Try to make that change because the certificate is the locally generated by the WLC your PC and most of the PC will display a certificate number since this is a Selfsigned certificate... you just need to accept that and then go normally.

  Meanwhile take a look at this document, which is really useful:http://www.cisco.com/en/US/products/ps6366/products_tech_note09186a0080a38c11.shtml

  Let us know the result.

• vCenter 5.5 and LDAP authentication

  Hello

  I'm new on using vCenter and had a quick question about LDAP authentication.  I installed vCenter as a device on my ESXI server and it seems to work fine, but when I connect the web client to vCenter I have no single sign on options to enable LDAP authentication

  So I did some research and a few posts mentioned that I had to enable SINGLE sign-on, so I have it configured as embedded will be fine then another message mentioned that I needed set up AD authentication on the vCenter server and ensure that the host to vcenter name was in the area...

  So I want to only LDAP authentication, I don't want to join my VMs to the domain.  So am I missing something?

  Thank you

  To be able to configure SSO, connect on the Web Client using the [email protected] account. With this account, you will be able to add your AD/LDAP as an identity Source and configure the permissions on the objects of the vCenter Server inventory...

  André

• APEX authentication method

  Authentication for APEX is work-related, say I create a work environment of HR, I can log in the workplace human resources administrator and choose the authentication method (APEX, Ldap...) to use for my job of human resources. Is it okay for the APEX? Y does it that no detail documents concern the configuration for LDAP authentication? Thanks for your comments.
  
  Kevin

  Kevin Liao wrote:
  Authentication for APEX is work-related, say I create a work environment of HR, I can log in the workplace human resources administrator and choose the authentication method (APEX, Ldap...) to use for my job of human resources. Is it okay for the APEX? Y does it that no detail documents concern the configuration for LDAP authentication? Thanks for your comments.

  Kevin

  Hey Kevin,

  I do not understand the first question completely, except for the fact that you can choose/set authentication methods for an application (under the shared components). As for the second question on LDAP authentication, there are a number of discussions in this forum that might be useful:
  Re: AD authentication

  ADS with Apex

  Hope the above information helps.

  Thank you
  Rohit

• Custom authentication tokens

  "Adobe Flash Access Overview on protected streaming" white paper States the following:

  Flash Access supports the business logic of the licensing stage decoupling based on the chips in use with Flash Media Server deployments. For example, when users visit a web portal for rental or to subscribe to the content, they may need to authenticate by providing a user ID and password to confirm their registration. They might also need a financial transaction. The web portal enters the results of these operations in an authentication token that is sent to the client application. The customer can then include the token in the licence application. The license server checks the authenticity of the token before issuance of the licence. Check token is stateless and was completed independently by each server without reference to a database or another shared state. Token is based on a secret or public key shared infrastructure (PKI).

  This raises the following questions:

  • How the web portal must generate the token?  This is a serialized AuthenicationToken or some other binary token?
  • If it's an AuthenicationToken, then how the web portal must generate a token such as this feature is part of the license server?
  • How the chips are based on a shared secret or PKI? What is incorporated into the class AuthenticationToken ?

  As I read, the paragraph refers to the regime "of custom authentication", not the authentication scheme name of user/password supported and as such, it is not to use serialized Flash Access AuthenticationTokens.  What is meant by "custom authentication" is quite honestly, not very clear in the documentation. I believe that the following scenerios should work, if I would be interested in your comments from anyone:

  In the first scenario, the "portal" should generate a custom binary token and pass this token to the client flash in response. How the token is passed is an exercise left to the reader. It could be loaded via a cookie, JavaScript or ActionScript. It doesn't really matter. Nevertheless, the token is eventually read by the Flash client and applied using the DRMManager.setAuthenticationToken (...) method. The license server must then retrieve the token by using RequestMessageBase.getRawAuthenticationToken (...).  In this case, the token format is completely defined by the developer or provider. The flash never access client issues a query for the authentication License Server Manager (/flashaccess/authentication/v1 / *).

  A second case, which I am not sure would work, would be the flash client requests a token for authorization as usual, using DRMManager.authenticate (...), but the license server authentication requests handler returns a token custom instead of a serialized AuthenticationToken. The workflow would then proceed as described in the first case.

  A third case, the Flash client is able to authenticate with the name of user and password standard schema, but the license server may ignore the username/password real name (data can be same passwords and usernames dummy). The license server would generate an AuthenticationToken, but would benefit from ApplicationProperies to store its information "custom token. The token would be then sent back to the customer and in turn transmitted to the same license server. The license server then inspect AuthenticationToken.getCustomProperties to determine the appropriate course of action.

  No matter what scenario is used, I have a few concerns with custom authentication tokens:

  First of all, this forum has several questions about custom authentication tokens. The documentation is not clear on what is intended and how exactly these tokens must be produced, transferred and consumed. It would be very useful for Adobe to provide an example with its reference implementation code.

  Second, as developers of server Flash Access License remain to design their own authentication scheme customized, there is a real concern that the invented approach can be precarious, allowing re-use of authentication tokens. A published set of best practices would help to ensure custom tokens are generated in a way that does not leak the information, allow attacks by replay or session hijacking.

  Finally, there seems to be some confusion about the use of tokens for authentication and authorization. The reference implementation clearly only use them for authentication, as the RefImplLicenseReqHandler makes additional checks the database for the authenticated user is allowed (subscriber) to access the content.  However, the paragraph quoted above suggests using these tokens for authentication and authorization. At least, that's what I understand by the notion that "audit token is stateless and was completed independently by each server without referring to a database or other shared state. I don't see how that's possible, unless the token contains authentication and authorization information. I'm wrong?

  I appreciate the thoughts of someone else on the custom authentication tokens. Thank you.

  -Aaron J

  The workflow for "custom authentication" is exactly what you described in your first scenario.  Namely, the client application gets a token through certain channels and calls DRMManager.setAuthenticationToken (...) to provide the token. When the client requests a license from the license server, this token is included in the request. The server application calls RequestMessageBase.getRawAuthenticationToken (...) for the access token and perform any validation is required for this type of token before issuing the permit. With a custom authentication, the SDK AuthenticationToken class is not used - this class is only used to represent the authentication tokens issued by using the name of user and password Flash Access authentication scheme.  A custom authentication token can be binary data - the Flash Access SDK is not involved in the generation or to consume these chips - it's your server implementation to manage the following steps.

  The motivation behind the 'custom authentication' scheme is not to force content providers to invent a new way to authenticate users, but to allow you to take advantage of all infrastructure you already have in place.  For example, if you are already running the SAML tokens to authenticated users, you can continue to do so, and you would just plug the SAML validation code in your license server. As a general rule, an authentication token is signed to prevent tampering. It would be possible to generate a signature using a symmetric key or with a private key. Then, checking on the server would involve checking the signature, either by using the same shared symmetric key or with the public key corresponding to the private key. (This is what is meant by 'token is based on a secret or public key shared infrastructure (PKI) ")

  Although the API reference to "authentication tokens", it would also be possible to take advantage of this authorization mechanism. For example, if you have a web portal to access the information on which a user is allowed to access the content, the Portal could issue an authorization token that says that the user X is allowed to play the content Y and Z. When the license server receives this token in a license application for content, simply, check the token is still valid and that the token States it is allowed to grant access to the content Y. This workflow, the license server doesn't have access to the database that contains authorization information, making it easier to deploy the server in a highly scalable way.

  Is this address your questions and concerns?

• MRI - authentication problem

  Hi all
  My question is about authentication in MRI.
  
  My environment is
  -Windows 2003 Server SP2.
  -Active Directory with all users
  -All desktop computers are in the field
  -Portable computers are not in the field
  
  When a user tries to connect to the IRM sealing/gavel a document via any desktop computer, everything is OK. But the same work via laptop can not be done. Login is necessary even within the field and nevers connects with the repository of the MRI.
  
  Any idea?

  Hello

  This is correct behavior of the product. In fact, it could be described as a perfect description of our implementation of Windows authentication. Machines outside the field are not approved.

  Kind regards
  Frank.