I had to build a sign-in page for some of our subsidiaries. The initial page queries their local LDAP and if the correct credentials are entered they are then presented with two bookmarks. The 1st bookmark goes to a custom website which I post the userid to and then logs in. The 2nd bookmark goes to a different web that is supposed to prompt for a username and password. Instead, I get a dialog prompting for username, password, and realm with the realm prefilling itself in with the domain. This login is a local login and not a domain login and I'm confused as to why it is coming up this way. The server where the web resides is a domain server, but I'm trying to login to the website using local credentials, not the server itself which I think the SA may be going after. At the end of the URL after clicking on the bookmark, I see: &domain=MY.CORP.COM&sidebar=off&proxy=0&ssoType=3 I'm fairly new to all of this and greatly appreciate any suggestions on how to resolve this. Thanks, Rob ... View more

We currently have the OAC client installed on all of our corporate laptops for using 802.1X wireless in the office and for connecting to outside non-802.1X access points as well. It works very well and the user is presented with a blue taskbar icon whenever there is a good connection whether it talks to the UAC or not. The end users have basically trained that the blue icon is a sure sign they have a good connection. Now we want to use Odyssey to also manage their wired connections when in the office with 802.1X authentication. I was able to create a custom update installer that does this and it works well. The thing that has changed is that when someone is on a wireless connection and not connected via ethernet the taskbar icon is black even though they have a good wireless connection because it knows the wired one is disconnected. This doesn't happen in the reverse situation because we use wireless suppression so whenever there is a good wired connection the wireless is disabled. I had opened a case with JTAC that got escalated to engineering and even through my SE to development requesting an option that allows me to have the taskbar icon stay blue as long as there is at least one connection. The response from everyone was that this is as designed and my request could not be accommodated. So my question to fellow users of OAC who use it both wired and wireless is how did you handle this in your organization? Did you simply tell your users that a black icon doesn't necessarily mean there is a problem? Thanks, Rob ... View more

IC 4500 running 3.0R2 (build 13209) I was wondering if anyone has had success in using Odyssey and machine authentication without a certificate? I'm trying to use EAP-PEAP with the Realm prefilled on the the JUAC tab. I have it set to change to user auth once someone logs in. My whole intention for this is so we can RDP to a PC on a 802.1 port. A policy trace shows (sanitized): PTR23373 2009/09/15 13:19:19 - [0.0.0.0] - PCNAME.DOMAIN.COM(Computers)[] - User lookup failed to LDAP server Computers LDAP: Info PTR23334 2009/09/15 13:19:19 - [0.0.0.0] - PCNAME.DOMAIN.COM(Computers)[] - Sign-in rejected using auth server Computers LDAP (LDAP Server). Reason: Failed Info PTR23337 2009/09/15 13:19:52 - [0.0.0.0] - PCNAME.DOMAIN.COM(Computers)[] - Requesting more sign-in prompts as required by auth server "Computers LDAP" Info PTR23329 2009/09/15 13:19:52 - [0.0.0.0] - PCNAME.DOMAIN.COM(Computers)[] - Resuming sign-in process Info PTR23333 2009/09/15 13:19:52 - [0.0.0.0] - PCNAME.DOMAIN.COM(Computers)[] - Sign-in prompt password = "****" Info PTR23370 2009/09/15 13:19:52 - [0.0.0.0] - PCNAME.DOMAIN.COM(Computers)[] - Attempting to authenticate user "PCNAME.DOMAIN.COM" with auth server "Computers LDAP" I'm at a loss as to whether LDAP (AD) is rejecting the password or if it is a problem of locating the machine account itself. Nothing is logged on the Active Directory side which makes me suspicious it is not finding the account in the AD OU. Any thoughts appreciated. Thanks, Rob ... View more

I have successfully implemented 802.1x on our Cisco switches using an IC 4500. I took it one step more and am using MAB and a MAC Addr Realm to authenticate our Avaya IP phones. All of that is working well. What I'd like to do now is create a guest VLAN on the switch for users who fail authentication to fall into and direct them to a username/password login page before allowing them to access the Internet. I'd prefer to do this without using an Infranet Enforcer point if possible. Appreciate any thoughts on how best to accomplish this. Thanks, Rob ... View more

We are looking at using the UAC for preventing unauthorized use of our switchports (802.1x with host checking). We have already deployed the Odyssey client to workstations for a wireless implementation. I have verified that a PC authenticates and does host checking through the Cisco switch to the UAC and then gets put on the data VLAN as it should. The problem I am having is I need to authenticate Avaya IP phones too. I created local accounts for the phones since they use the MAC address as the username. The phone 802.1x authentication occurs on the data VLAN and is successful, but then the phone never receives DHCP for the voice VLAN. If I remove the 802.1x requirement from the switchport the phone does what it supposed to which is to boot on the data VLAN and then DHCP options move it to the voice VLAN. With 802.1x enabled it appears the phone stays on the data VLAN. Is there something I need to configure in the UAC to allow it to change VLANs? Thanks! Rob ... View more

I doubt there is a way to do this, but I thought I'd check the same to be sure. Our helpdesk occasionally has to have users log off and back on to rejoin the domain or recache their workstation credentials across VPN. They have realized that the Odyssey client's wireless connection dies when you do a log off. They would like it to stay persistent in the background. I know there are options for altering the Gina and also using a machine account but we can't use either because we already have an encryption program in the Gina and the users who have this problem are working remotely so there is nothing for the machine account to authenticate against. Any other options I may have missed or should I stick with my response that the user will need to find wired access? Thanks, Rob ... View more

I was wondering if anyone had any suggestions for my current issue. My plan is to create 2 unique odyssey installers for the two domains we have in our company. I would like to prepopulate the realms and roles for each domain but it doesn't appear to be passing through from the JUAC tab. I also read that you can send the realm by adding a suffix of @realm to the end of the username, but I want odyssey to pull the username from the logged on user and can't figure out how I would combine the two if it is possible? As it stands, I have all wireless clients (both domains) coming from the same wireless controller so I only have one radius client/location group defined. They all hit the same sign-in policy and it has separate realms for each. The problem I'm having with this scenario is that it is running the host checking rules defined for both domains and one of the checks fails each time since they are domain specific. I expected to be prompted with a realm list because there is more than one but it is not happening. After one host check passes and the other one fails the client does find itself in the right realm, but this does not seem the correct way to do this. Any thoughts on how to successfully have the odyssey client send the realm and role and the logged on username would be greatly appreciated. Thanks, Rob ... View more