The mailing list for users of the eduroam Configuration Assistant Tool (CAT)

[Stefan Winter <address@concealed>]

Hi,

> Any thoughts?

Yes: the text immediately following "Test FAILED" explains the situation.

We couldn't actually get through to the "flesh" of your authentication
server because it blocked our connection attempt immediately when seeing
an outer ID it doesn't recognise.

If you've configured CAT with anonymous outer IDs such as
"anonymous@..." but the server isn't configured to allow anonymisation
(say, Microsoft NPS typically does NOT allow this out-of-box) then the
installers for end users will fail. That would be a misconfiguration in
your CAT settings then; you either have to turn off anonymous outer IDs,
or choose an outer ID which exists in the NPS user DB, or turn off
rejection of anonymous outer IDs in NPS.

If you did not actually configure anonymous outer IDs in CAT, then this
is "not necessarily an error": we simply don't know an actual user ID to
test with, so have to make up one, and NPS might rightfully reject that
guessed attempt. The solution then is to configure the "Use special
Outer Identity for realm checks:" which then allows us to get through to
the server. You need to configure an actually existing username in that
field for this to work. A subsequent run of the realm checks will then
either work, or produce more specific error messages because we can then
analyse the EAP conversation more thoroughly.

Greetings,

Stefan Winter

-- 
Stefan WINTER
Ingenieur de Recherche
Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et
de la Recherche
2, avenue de l'Université
L-4365 Esch-sur-Alzette

Tel: +352 424409 1
Fax: +352 422473

PGP key updated to 4096 Bit RSA - I will encrypt all mails if the
recipient's key is known to me

http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

Attachment: 0xC0DE6A358A39DC66.asc
Description: application/pgp-keys

Attachment: signature.asc
Description: OpenPGP digital signature