PROBLEM DESCRIPTION:
MS-IAS Radius service will not authenticate remote access users in WindowsNT domains.
MS-IAS Radius service modifies the fully qualified user name by adding it’s own domain name as a prefix to the user’s logon name.
Since the user is not a member of that domain, the IAS Radius service cannot authenticate the user and rejects the request.
ENVIRONMENT:
Internet Authentication Service (IAS) is running as a service on a Windows2000 server named “MHSRADIUST”.
The server “MHSRADIUST” is in an Active Directory domain named “MHSADT”
There are trusts between the Active Directory Domain “MHSADT” and the WindowsNT Domains “MHSLB”, “MHSOC”, etc.
The Windows2000 IAS hot-fix patch has been applied to the Windows2000 server running IAS
The Nortel VPN switch and the IAS Radius server “MHSRADIUST” are configured and communicating fine.
WHAT HAPPENS:
1) The Nortel VPN switch sends an authentication request packet to the IAS Radius server
2) The IAS Radius server will successfully authenticate the user as long as the user is a member of the domain “MHSADT”
3) The IAS Radius server will not authenticate the user if he is a member of any domain other than “MHSADT”
4) The IAS Radius server keeps adding the prefix MHSADT\ to the users logon name.
For example, if the remote user enters the logon name: jlboyd the IAS Radius server uses the fully qualified user name “MHSADT\jlboyd
Since jlboyd is NOT a member of the domain MHSADT the IAS Radius server cannot find or authenticate the user and password and
denies access.
I have tried using all possible logon syntaxes: MHSLB\JLBOYD MHSLB/JLBOYD
jlboyd@mhslb jlboyd@mhslb.mhs
In each instance, the logs show that the IAS Radius server is adding the prefix MHSADT\ to the logon name.