NPS Radius Authentication

[Woodster1975]

I am having an issue whilst attempting to get FirstSpot to authenticate users. I have followed the guide (http://patronsoft.com/firstspot/doc/firstspot_guide.pdf), but am still unable to log on. Please can you advise me on how to get this working correctly?

[alan]

Can you also check out the article at http://patronsoft.com/forum/viewtopic.php?t=1175 ?

What is the symptom of your problem?
_________________
~ Patronsoft Limited ~

[Woodster1975]

I have installed FirstSpot on a virtual machine with 3 NICs. One for internet access, one for client access and one for access to the network with the domain controller (2008R2 native) running NPS. On attempting to log on, I am being denied access.

[alan]

FirstSpot is designed with 2 network cards in mind. FirstSpot should connect to your NPS either locally or via the Internet Network Interface (i.e. Internet side).

Also, did the default ODBC Authentication Mode work okay? You might want to test the default ODBC Authentication Mode first before moving on to the RADIUS Authentication Mode.
_________________
~ Patronsoft Limited ~

[Woodster1975]

The default ODBC configuration worked fine. I will try it with 2 NICs rather than 3 and see if that resolves the issue.

[Woodster1975]

I am unable to authenticate using 2 NICs. I have set the DC up on the guest NW. Please can you advise on the logging and fault finding procedure for this?

[alan]

First, let's start with Authentication only (i.e. without DLL).

Can you reproduce your issue, and then post your firstspot_gw_srv_[timestamp].log under FirstSpot\log directory?
_________________
~ Patronsoft Limited ~

[Woodster1975]

Here is the log from when it fails:-

24/01/2012 10:19:23 ** StartServiceThread: (check) OP_ADD [0]
24/01/2012 10:19:39 ** AuthLoginRADIUS: Authenticate[test@*********.***.**]
24/01/2012 10:19:39 ** RadiusClient - radius server : 10.20.7.2
24/01/2012 10:19:39 ** RadiusClient - localhost 10.20.7.1
24/01/2012 10:19:39 ** RadiusAuthenticate - request Authenticator
24/01/2012 10:19:39 ** radiusPacketFixedAttrib =>
24/01/2012 10:19:39 ** <=radiusPacketFixedAttrib
24/01/2012 10:19:39 ** RadiusAuthenticate - password : *hidden*
24/01/2012 10:19:39 ** RadiusAuthenticate - socket valid.
24/01/2012 10:19:39 ** RadiusAuthenticate - using radius server 1
24/01/2012 10:19:39 ** RadiusAuthenticate - recvfrom sock err 10054
24/01/2012 10:19:39 ** RadiusAuthenticate - using radius server 2
24/01/2012 10:19:39 ** RadiusAuthenticate - sendto sock err 10047
24/01/2012 10:19:39 ** AuthLoginRADIUS: Access Rejected
24/01/2012 10:19:39 ** StartServiceThread: (check) OP_ADD [0]

[alan]

Can you post your config.ini file also?
_________________
~ Patronsoft Limited ~

[Woodster1975]

;
; Description : FirstSpot setting ini file
;
; Filename : config.ini
;

; Note: use a backslash to separate directories and files, those lines starting with
; a semi-colon is considered as comment.
;
; Warning : please don't change this file without supervision of a PatronSoft Engineer
; It is highly recommended that you change the FirstSpot setting in the Web-based Configuration Manager

[version]
version=Trial
versionDesc=7.0.3
versionLang=English

[MNS]
; number of return paths
num_return_path=0
return_path0=

[DHCP]
leasetime=2880
num_ignored_addr=0
ignore_addr0=

[Port Filter]
flt_num=
flt_0=

[UserPortFilter]
user_pf_size=0
flt_num1=
flt_num1_name=
flt1_0=

[QOS]
dl=
ul=
qos_num=
qos_0=

[Client Pass]
num_mac_addr=0
mac_0=
num_ip_addr=0
ip_0=

[proxyARP]
ip_num=0
ip_addr0=

;
; Redirect Login Page php file
;
[loginPhp]
Login_enable0=
Login_php_Num0=

;
; Gateway Settings
;
[gateway]
;Print Log Table
Datasource_Printlog=printlog

;Shared Secret Table Name
Datasource_Shared_Secret_Tablename=fssecret

;maximum timelimit per session in minutes (global), 0 = never
sessionlimit =

;URL tracking, default off
Trace_URL=0

;URL tracking interval, do not log the same url for particular user in x mins
Trace_URL_Interval=30

;URL tracking temp table
datasource_tmp_URL_tablename=tmpurl

;extra-information field table name
Datasource_extra_field_table = aexlog

;for scenario2 communicate
Datasource_msg_Tablename=fsmsg

;for In-browser message
Datasource_ibmsg_Tablename=ibmsg

;demo_mode=on, off (default)
;
;This demo_mode parameter is for FirstSpot channel partners demonstration purpose
;If demo_mode=on, FirstSpot DNS Server and Web Server will perform a catch-all on all
;requests. After the user login, the client will always see the "firstspotdemo" page.
demo_mode=off

;redirect user to cart.php when login fails
redirect_cart=1

;Client Isolation, NetBIOS over TCP/IP, Default is Disabled
netbios=1

;Scenario 2 (Distributed Network Topology)
scenario2=0

;FirstSpot Site ID
siteID=

; Post-Startup Batch File Path Name
batch_filePath =

; lan's subnet mask (please change this through Configuration Manager only)
;
subnet_mask =255.255.255.0

; domain name server IP address
;
DNS =0.0.0.0

; domain name server IP address
;
preferred_DNS =0.0.0.0

; domain name server IP address
;
alternate_DNS =0.0.0.0

; username
;
user =firstspot

; password
;
pass =a03af780c0f2959f26512a2cc8c2efb6

;Number of maximum administrator account
max_admin_account = 30

;Administrator username
admin_username0 =
admin_username1 =
admin_username2 =
admin_username3 =
admin_username4 =
admin_username5 =
admin_username6 =
admin_username7 =
admin_username8 =
admin_username9 =
admin_username10 =
admin_username11 =
admin_username12 =
admin_username13 =
admin_username14 =
admin_username15 =
admin_username16 =
admin_username17 =
admin_username18 =
admin_username19 =
admin_username20 =
admin_username21 =
admin_username22 =
admin_username23 =
admin_username24 =
admin_username25 =
admin_username26 =
admin_username27 =
admin_username28 =
admin_username29 =

;Administrator password
admin_password0 =
admin_password1 =
admin_password2 =
admin_password3 =
admin_password4 =
admin_password5 =
admin_password6 =
admin_password7 =
admin_password8 =
admin_password9 =
admin_password10 =
admin_password11 =
admin_password12 =
admin_password13 =
admin_password14 =
admin_password15 =
admin_password16 =
admin_password17 =
admin_password18 =
admin_password19 =
admin_password20 =
admin_password21 =
admin_password22 =
admin_password23 =
admin_password24 =
admin_password25 =
admin_password26 =
admin_password27 =
admin_password28 =
admin_password29 =

;Administrator parameter
admin_parameter0 =
admin_parameter1 =
admin_parameter2 =
admin_parameter3 =
admin_parameter4 =
admin_parameter5 =
admin_parameter6 =
admin_parameter7 =
admin_parameter8 =
admin_parameter9 =
admin_parameter10 =
admin_parameter11 =
admin_parameter12 =
admin_parameter13 =
admin_parameter14 =
admin_parameter15 =
admin_parameter16 =
admin_parameter17 =
admin_parameter18 =
admin_parameter19 =
admin_parameter20 =
admin_parameter21 =
admin_parameter22 =
admin_parameter23 =
admin_parameter24 =
admin_parameter25 =
admin_parameter26 =
admin_parameter27 =
admin_parameter28 =
admin_parameter29 =

; network interface card connected to Internet (after modify this, need to restart FirstSpot)
;
publicNIC=Internet

; network interface card connected Hotspots or visitor-based networks (after modify this, need to bind the FirstHop driver
; to this new card and unbind the FirstHop driver from ALL other cards, then reboot Windows)
;
privateNIC=Client Access NW

; data source for user login
;
Datasource =C:\Program Files (x86)\FirstSpot\datasource\firstspot.dsn

; datasource table for user login
;
Datasource_Tablename = fsusr

; datasource table for user login
Datasource_Plans_Tablename = fsplans

; enable session logging into the datasource log table
session_log =ON

; datasource table for user session logging
;
Datasource_Log_Tablename = fsusrlog

; datasource table for PayPal
;
Datasource_PayPal_Table=ppal

; port used by Gateway Service
;
port =5786

; port used by Authentication Server
;
auth_port =5788

; port used by ssl site
;
ssl_port =5789

; Greeting message displayed in login page
;
greeting_msg =Welcome to our Hotspot!

; Enable to show InfoBox
;
show_infobox =ON

; Logout automatically when Infobox is closed
;
check_infobox_closed =OFF

; port used by infobox
;
infobox_port =5795

; for client's browser not fully support popup infobox (detect by user agent)
;
not_support_popup_option =1

; login page filename which dispatcher will call
;
loginpage =login_select.php

; login form filename which login_select.php will call
;
loginform =login_form.php

; anonymous login form filename which login_select.php will call
;
a_loginform =alogin_form.php

; idle time (minutes) allowed for authenticated users
;
idle_timeout =10

; gateway IP address (please change this through Configuration Manager only)
;
gateway_IP =10.20.7.1

; allow access to config manager from private network?
;
access_from_private =off

; allow access to config manager from public network?
;
access_from_public =off

; license file path
;
licensepath =C:\Program Files (x86)\FirstSpot\

; session handling mode, 0 for MAC-based, 1 for IP-based
session_handling =0

; path for dhcp config
dhcppath =C:\Program Files (x86)\FirstSpot\dhcp\dhcpservice.ini

; dhcp mode, 0 = auto, 1 = static, 2 = disabled
dhcpmode =0

; for static dhcp only, path of the Ip MAC mapping list
static_dhcp_path =C:\Program Files (x86)\FirstSpot\StaticDHCP.txt

; anonymous login
anonymous_login =off

; secret enable
secret_enable=off

; secret code
secret_code=0aed120c6f7090a5b26a4c93df382b21

; anonymous login user table name
Datasource_Anonymous_Tablename =fsa

; anonymous login log table name
Datasource_Anonymous_Log_Tablename =fsalog

; password offloading mode
pwd_offload =off

; password encryption directory path
encrypt_path =C:\Program Files (x86)\FirstSpot\dispatcher\encrypt_pwd.exe

; initial air time in minutes for self signup users
self_sign_up_credit=0

; initial plan for self signup users
self_sign_up_plan=Self Sign-up Init

; self signup option
self_sign_up_option=0
self_sign_up_redirect=http://www.google.com

; self signup filtering
self_signup_filter=1

; null=no filter, 0 = signup once, >0 after x mins
self_signup_period=

; 1=not show sign up form
self_signup_not_show_form=0

;CAPTCHA option
self_sign_up_captcha_check=on
login_captcha_check=off

;use 3 party ssl cert 0=yes 1=no
ssl_cert=1

;secure socket layer for authentication
;443 for enabled SSL, auth_port=ssl_auth_port for disabled ssl
ssl_auth_port=5788

;rewrite engine for http to https redirection
rewrite_engine=off

;maximum fail attempt allowed
max_attempt=

;If user accesses http://10.20.7.1:5788 directly, redirect the request to any non-existing ip,
;so that driver can capture the request properly.
;DO NOT put any unresolvable domain name here
redirect_address=http://10.42.253.11/logged_in.html

;port to handle https request in apache when user is not authenticate
redirect_port=5790

; DNS suffix
dns_suffix=firstspot.org

;unauthorized access restricted to port 80 and 443 only.
; On=1, Off=0
restricted_redirect=1

; start up redirect
; 0= no redirect, 1=redirect to below link, 2=redirect to info box
start_up_redirect_option =0
start_up_redirect_url =
start_up_redirect_wait =5

; Redirect page picture (filename)
;
redirectpage_pic_name=
redirectpage_pic_name_html=

; Login page picture (filename)
;
random=0
loginpage_pic_count=1
loginpage_pic_html0=
loginpage_pic_html1=
loginpage_pic_html2=
loginpage_pic_html3=
loginpage_pic_html4=
loginpage_pic_html5=
loginpage_pic_html6=
loginpage_pic_html7=
loginpage_pic_html8=
loginpage_pic_html9=
loginpage_pic_html10=
loginpage_pic_html11=
loginpage_pic_html12=
loginpage_pic_html13=
loginpage_pic_html14=
loginpage_pic_html15=
loginpage_pic_html16=
loginpage_pic_html17=
loginpage_pic_html18=
loginpage_pic_html19=
loginpage_pic0=autumn.jpg

;maximum number of concurrent users, blank / 0 = unlimited
max_conc_user=

; Auto refresh interval of Status tab in seconds, blank for no auto refresh
time_refresh=

; Scratch mode
scratch_login=off

; Username & Password mode and Scratch Code mode
username_plus_scratch_login=off

; support v6 style scratch code in (Username & Password mode and Scratch Code mode)
accept_v6_scratch_code=true

; Display Self Sign-up switch
display_self_sign_up=ON

; Private gateway domain name
gateway_domain=************.**.uk

; Show IP or domain name in URL (0:IP, >0:DN)
show_domain_URL=1

; port used by Default Instant Keywords
iKey_port=5801

; Free Access mode switch
free_access_mode=on

; Plan applied to Free Access users
free_access_plan=Free Access Plan

; Availablity of a new Free Access session (0:one-off, 1:daily, 2 mins after last session start time)
free_access_option=0

; Daily reset time to offer new Free Access session
free_access_reset_time=00:00

; Waiting minutes before offering a new Free Access session
free_access_reset_minute=60

; Forward traffic to proxy (1: ON)
forwordToProxy=0
forword_proxyAddress=
forword_proxyPort=
transparent_proxy_port=5804

; sign-up using SMS
esms_mode=off
esms_smtp_domain=
esms_smtp_port=
esms_sendmail_from=
smsgateway=yoursmsgateway.com
current_scratchcode=

; Allowed Hosts Settings
;
[allowed hosts]
; allowed hosts keywords file path
;
hosts_keywords_path =C:\Program Files (x86)\FirstSpot\AllowedHostsKeywords.txt

; allowed hosts IPs file path
;
hosts_ips_path =C:\Program Files (x86)\FirstSpot\AllowedHostsIps.txt


; Bandwidth Throttle Settings
[bw_throttle]
; Bandwidth Throttle Mode
bt_mode =0

; Overall Upload Limit (at least 20KB/s recommended)
bt_ul_limit =0

; Overall Download Limit (at least 20KB/s recommended)
bt_dl_limit =0

; low, medium and high definition
bt_low=100
bt_medium=50
bt_high=20
bt_drop_period=2

; Dynamic BT
bt_dynamic=off
; Enforce Bandwidth Throttling when exceed (in Kbits/s)
bt_ul_exceed_limit=1024
bt_dl_exceed_limit=1024

[bwreset]
bwresetmethod=
bwresetperiod=
lastresetbw=
sdate=

[creditcard]
payment_method=ppal

[paypal]
; Business id
;
ppal_business=your_business_id@your_email.com

; URL for successful transactions
;
ppal_return=http://firstspot.org:5788/cart.php

; URL for cancelled transactions
;
ppal_cancel_return=http://firstspot.org:5788/cart.php

; trust "Pending"=="Complete"?
;
ppal_pending_release=no

; the settlement currency
;
ppal_base_currency=USD

; URL for notify
;
ppal_notify_url=http://fixed_ip:5789

; Starting number for invoice
;
ppal_invoice_start=1

; 20080724 added setting for PayPal Website Payments Pro Direct Payment
[paypal_direct]
; setting for PayPal Payments Pro Direct Payment
;
; api username
ppal_direct_api_username=your_business_id.your_email.com
;
; api password
ppal_direct_api_password=
;
; api signature
ppal_direct_api_signature=

[worldpay]
; Installation id
;
wpay_instID=your_installation_ID

; the settlement currency
;
wpay_base_currency=USD

; URL for notify
;
wpay_notify_url=http://fixed_ip:5789

; Test Mode
; 100 : test mode - always successful validation
; 101 : test mode - always failed validation
; 0 : test mode - live mode, not testing
;
wpay_testmode=0

[AuthorizeNet]

;login id
aNet_id=

;transaction key
aNet_key=

aNet_hash=

aNet_base_currency=USD

; URL for notify
aNet_notify_url=http://fixed_ip

; Test Mode
; 0 : test mode - live mode, not testing
; 1 : test mode - testing only
aNet_testmode=0

[googleCheckout]
; Merchant id
;
checkout_merchant_id=

; URL for successful transactions
;
checkout_return=http://firstspot.org:5788/cart.php

; URL for cancelled transactions
;
checkout_cancel_return=http://firstspot.org:5788/cart.php

; the settlement currency
;
checkout_base_currency=USD

; URL for notify
;
checkout_notify_url=http://fixed_ip:5805

; google chckout gateway port (ssl)
;
checkout_port=5805

[User_defined_payment]
id=login_id
pin1=
pin2=
currency=USD
notify_url=http://

[PrinterOn]

PrintSupport=0
SiteURL=
SiteUID=
SiteAuth=
; show siteURL
show_URL_login=1
show_URL_infobox=1

[lang]
; default language file
default_lang_file=lang.php
default_lang_file_attributes=English;en,en-us;iso-8859-1
; number of other language files
lang_fileNumber=0
; other luguage files
lang_file1=
lang_file1_attributes=
lang_file2=
lang_file2_attributes=
lang_file3=
lang_file3_attributes=
lang_file4=
lang_file4_attributes=
lang_file5=
lang_file5_attributes=
; show character encoding
; 0 : hide
; 1 : show
show_charset=1

lang_pack_file=custom_lang.php
cmlang_pack_file=custom_cmlang.php
last_logout=logout
this_logout=logout
last_info=infobox
this_info=infobox
last_cart=cart
this_cart=cart
key_0=
url_0=
ReqSignUp01=off
ReqSignUp02=off
ReqSignUp03=off
ReqSignUp04=off
ReqSignUp05=off
ReqSignUp06=off
ReqSignUp07=off
ReqSignUp08=off
ReqSignUp09=off
ReqSignUp10=off

; Control display of optional sections in login page
disable_show_reminder=0
disable_show_example=0
disable_show_link=0
disable_show_tc=0

; Setting of cart description
[cart]
reset_bw_count_upon_purchase=1
; Action of data transfer quota (0/blank=Replace 1=Add)
add_replace_bw_quota=0
; Use plan settings to overwrite user's suspend condition option (1/blank=Yes 0=No)
overwrite_user_suspend=1
max_slot_open=0

[radius]
use_radius=true
ServerIP=10.20.7.2
AuthPort=1812
AccPort=1813
Secret=password
FSVendorID=2004
; second RADIUS
use_two_radius=false
ServerIP_2=10.20.7.2
AuthPort_2=1812
AccPort_2=1813
Secret_2=secret
FSVendorID_2=2004

Datasource=C:\Program Files (x86)\FirstSpot\datasource\radius.dsn
Datasource_Tablename=fsRadius
Acc_Start=true
Acc_Stop=true
Acc_FSLogin=
Acc_FSLogout=
Acc_FSWriteLog=
Acc_FSPrinterOn=
;Acc_FSLogin=true
;Acc_FSLogout=true
;Acc_FSWriteLog=true

[radiusAuthentication]
NAS_IDENTIFIER=FirstSpot
NAS_IDENTIFIER_2=FirstSpot
NAS_IP_ADDRESS=10.20.7.1
;NAS_IP_ADDRESS=the private nic ip, this can be edited.
;CALLING_STATION_ID=client nic mac or ip, depends on the Firstspot setting, this can not be edited.
;CALLED_STATION_ID=firstspot private nic mac, this can not be edited.

[radiusCustomAttribute]
ACCT_STATUS_FSLOGIN=
ACCT_STATUS_FSLOGOUT=
ACCT_STATUS_FSWRITELOG=
;Vendor spec type for Firstspot
;fixed value can not be changed.
;
;FS_AUTH_TIMELEFT=1
;FS_AUTH_ACCUMBW=2
;FS_AUTH_BWQUOTA=3
;FS_AUTH_BWCOUNT=4
;FS_AUTH_ULLIMIT=5
;FS_AUTH_DLLIMIT=6
;FS_AUTH_LOGINTIME=7
;FS_AUTH_LOGOUTTIME=8
;FS_AUTH_TIMEDIFF=9
;FS_AUTH_BWUSAGE=10

;Account Status Type Attributes, can be changed.
;
;default ACCT_STATUS_FSLOGIN=217
;default ACCT_STATUS_FSLOGOUT=218
;default ACCT_STATUS_FSWRITELOG=219

[prepaidCard]
random_usr_prefix=
random_usr_suffix_salt=123456789
random_usr_suffix_length=5
pwd_salt=abcdefghjkmnpqrstuvwxyzABCDEFGHJKMNPQRSTUVWXYZ
pwd_length=7

[ACL]
num_acl=0

[fssmtp]
smtp = false
MailLogOffset=24
IspSmtpDomain=
SmtpPort=
IspSmtpAuthLogin=false
IspSmtpUserName=
IspSmtpPassword=

[users]
; 0= default format
; 1= past format option
slip_format_option =0
; default format
default_slip_title= Welcome to use FirstSpot System
default_slip_title_size= 0
default_slip_end= Thank You
default_slip_end_size= 0
; Past format
past_slip_title=
past_slip_title_size=0
past_slip_end=
past_slip_end_size=0

[NAT]
Enable=1
module=0
Type=0
NAT_AddrR_Count=0
NAT_portmap_count=0

[mac_filter]
mac_count=0
client_bl_log=on

[ip_filter]
ip_count=0

[FSFO]
mode=
BackupMode=2
Main_IP=
Main_NIC=
BackUp_IP=
BackUp_NIC=
Port=
;Current FirstSpot Machine ID for Load Balancing
MachineID=
;Other Load Balancing Machine Information
OtherLB_IP=
OtherLB_NIC=

[bulk]
enable_slip_preview=1
slip_per_page=5

[DataTransfer]
bwcount_dl=1
bwcount_ul=1

[IB]
;0=In-browser message OFF
;1=In-browser message ON
iBMsg=1
;2=Infobox (Always on)
iBMsg_infobox_mode=0
iBMsg_remindMin=5
proxy_port=5796
script_port=5802
iscript_path=C:\Program Files (x86)\FirstSpot\iscript.txt
;1=enable internet surfing break
iB_cb_redirect=0
iBMsg_interval=15
;0=do not redirect, 1=redirect delay
iB_redirect_option=1
; Break duration
iB_redirect_wait=15
;0= do not show redirect link, 1= show redirect link, 2= show redirect link delay
iB_redirect_showLink=2
iB_redirect_showLink_wait=5
;0= disable banner, 1= enable top banner
iB_banner_mode=0
; 1: Image, 2: frame
iB_banner_type=1
; frame width and height
iB_banner_frame_w=0
iB_banner_frame_h=0
; number of selected image
iB_banner_img_count=0

[Pool]
min_conn=3
max_conn=10

[URLTracking]
trace_URL_type=1
trace_URL_port=

[emailReport]
SmtpDomain=
SmtpPort=
SmtpAuthLogin=false
SmtpUserName=
SmtpPassword=
toEmail=
fromEmail=
enable_e_usr_log=true
; 0: daily, 1: Monday to Friday, 2: Monday to Sunday
e_usr_log_type=0
enable_e_url_log=true
; 0: daily, 1: Monday to Friday, 2: Monday to Sunday
e_url_log_type=0

[ui_customization]

[misc]
show_cart=yes
enable_chgpwd=1
time_reminder=0
remindMin=5
removePeriod=30
block_icmp=on
block_udp=on
_debug=1
pkt_period=20
_skip_nic_disable_enable=true
MsiNTProductType=3
VersionNT=601
PublicAdapterIP=10.42.253.11
PublicAdapterIpMask=255.255.255.0
oem=C:\Windows\INF\oem2.inf
oem_file=oem2.inf
oem_NAT=C:\Windows\INF\oem4.inf
oem_NAT_file=oem4.inf
PublicAdapterGateway=10.42.253.1
PrivateMAC=00155d020506

[alan]

Is the NPS RADIUS server in the Visitor Network Interface side? Can you switch to the Internet Network Interface side and try again?

You can also check out the NPS log for any suspicious error.
_________________
~ Patronsoft Limited ~

[alan]

BTW, the NPS log file should be under windows directory\System32\LogFiles (e.g. C:\Windows\System32\LogFiles) which contains information on what NPS receives from the RADIUS client.
_________________
~ Patronsoft Limited ~