Windows Forum

Ask something
Discussion Locked

MS-IAS Radius Problems

0 helpful
5 replies

by jboyd02

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

PROBLEM DESCRIPTION:
MS-IAS Radius service will not authenticate remote access users in WindowsNT domains.
MS-IAS Radius service modifies the fully qualified user name by adding it's own domain name as a prefix to the user's logon name.
Since the user is not a member of that domain, the IAS Radius service cannot authenticate the user and rejects the request.

ENVIRONMENT:
Internet Authentication Service (IAS) is running as a service on a Windows2000 server named "MHSRADIUST".
The server "MHSRADIUST" is in an Active Directory domain named "MHSADT"
There are trusts between the Active Directory Domain "MHSADT" and the WindowsNT Domains "MHSLB", "MHSOC", etc.
The Windows2000 IAS hot-fix patch has been applied to the Windows2000 server running IAS
The Nortel VPN switch and the IAS Radius server "MHSRADIUST" are configured and communicating fine.

WHAT HAPPENS:

1) The Nortel VPN switch sends an authentication request packet to the IAS Radius server
2) The IAS Radius server will successfully authenticate the user as long as the user is a member of the domain "MHSADT"
3) The IAS Radius server will not authenticate the user if he is a member of any domain other than "MHSADT"
4) The IAS Radius server keeps adding the prefix MHSADT\ to the users logon name.
For example, if the remote user enters the logon name: jlboyd the IAS Radius server uses the fully qualified user name "MHSADT\jlboyd
Since jlboyd is NOT a member of the domain MHSADT the IAS Radius server cannot find or authenticate the user and password and
denies access.

I have tried using all possible logon syntaxes: MHSLB\JLBOYD MHSLB/JLBOYD
jlboyd@mhslb jlboyd@mhslb.mhs

In each instance, the logs show that the IAS Radius server is adding the prefix MHSADT\ to the logon name.

5 replies

by dunduk

Realm names are used for network routing and authentication. They provide the identification necessary to forward authentication requests to the server that holds the user's credentials.

Using the CMAK wizard, you can specify a realm user-name prefix (such as Awesome/) or suffix (such as @Awesome) to be added to the user name that a user enters when connecting to your service. The realm name includes any separator characters, such as @ or /. If you specify the realm, users do not have to provide it themselves because Connection Manager automatically places the realm name before or after the user's name so that the user does not have to understand network routing in order to log on.

may be?

This discussion is closed to new replies.