Re: EAP-TLS with Google Secure LDAP - iPhone authentication issue

Alan DeKok via Freeradius-Users <[email protected]> Thu, 5 Mar 2026 20:31:00 -0500

Newsgroups	gmane.comp.freeradius.user
Message-ID	<[email protected]>

On Mar 5, 2026, at 10:36 AM, Helder Miolo <[email protected]> wrote:
> Hello, I am running FreeRADIUS 3.0 on Ubuntu 24.04.

  You should use 3.2.  It has a number of new features and fixed which aren't in 3.0.

> I am trying to
> authenticate users via WPA2-Enterprise using Google Secure LDAP as the
> backend.It turns out that Android phones are working perfectly, but iPhones
> are experiencing a similar error:
> 
> 5) ldap: ERROR: Attribute "User-Password" is required for authentication

  You can't do MS-CHAP authentication to an LDAP database.

> Problem:
> - IPhone forces MSCHAPv2 even when EAP-TTLS/PAP is configured

  ?  We're using iPhones with TTLS+PAP.  It works fine.

  IIRC, you can't select TTLS+PAP fro the UI.  But you can either set it using the "mobileconfig" tool, or you can create a mobileconfig file manually which sets TTLS+PAP.  It's just an XML file.

> -  radtest with PAP works successfully
> 
> Current configuration:
> - eap.conf: default_eap_type = ttls, ttls { default_eap_type = pap }
> - inner-tunnel: Auth-Type PAP and LDAP configured
> - libldap is using GnuTLS while FreeRADIUS uses OpenSSL (Ubuntu 24.04 issue)

  You will want to fix the last issue.  Using different TLS libraries in the same application is likely to cause issues.  When you run the server in debug mode, it will print large messages complaining about this.

  Alan DeKok.

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

signature.asc (application/pgp-signature, 833 B)