Security

Hi:

The release notes for CPPM 6.4 talk about this:

A new Service parameter, Re-attempt AD login with different Username formats, lets you
control re-tries with different user name formats to the Active Directory in MS CHAP v2
authentication. (#23701)

I couldn't find this. Does anyone know where this option lives in the GUI?

Thanks,

Tony

Server configuration > Service Parameters > Radius server

It's enabled by default.

Thanks for the reply.

The help file has not been updated with a full description of this option.

But it sure seems like a darned good idea to set this to FALSE to help avoid account lockouts.

Thoughts?

Does anyone know what the different formats are that CPPM will try?

Nevermind!

http://community.arubanetworks.com/t5/AAA-NAC-Guest-Access-BYOD/How-does-ClearPass-perform-MSCHAPV2-authentication-across-AD/ta-p/240056

#1 The username as provided

#2 The samAccountName as returned from the auth source

#3 The full username@domain