802.11X PEAP/EAP-GTC wireless problems

Question

Level 1

8 points

802.11X PEAP/EAP-GTC wireless problems

I have a WPA2 wireless network that uses PEAP/EAP-GTC to authenticate. The token in this case is an RSA key, where the credentials expire after 60 seconds. I have two problems.

First. The Macbook continuously wants to use keychain to provide cached credentials anytime it reauthenticates me. I can click Deny and it will prompt me with the login window, and this login window has a checkbox for 'Only use password once', which I check. But it still wants to use cached credentials each time. Is this fixable? I have tried deleting the entry in the keychain but it always gets recreated when I authenticate on the WLAN in question.

Second has to do with sleep mode. If the laptop goes to sleep, it will not prompt me to reauthenticate unless I turn off the airport adapter and turn it back on, or reboot. This is a bigger problem.

Any ideas?

Macbook Pro, Mac OS X (10.5.2)

Posted on May 1, 2008 6:19 AM

Reply

Answer 1

HozzMidnight Author

Level 1

8 points

May 6, 2008 8:40 AM in response to HozzMidnight

Any ideas here? The problem is getting worse. I have to fiddle with airport settings for 15 minutes sometimes to get authenticated. XP/Vista clients on the same network get on the first time, every time.

Reply

Answer 2

Adyis

Level 1

14 points

May 6, 2008 9:56 AM in response to HozzMidnight

This is a HUGE issue with the MBP and Airport. From what I have read through this forum is that Apple knows about the issue, has NOT fessed up, but a update is forthcoming with 10.5.4.

Reply

Answer 3

HozzMidnight Author

Level 1

8 points

May 15, 2008 11:58 AM in response to Adyis

Is there an ETA for that 10.5.4 update?

Reply

Answer 4

HozzMidnight Author

Level 1

8 points

Nov 4, 2008 7:38 AM in response to HozzMidnight

Long story short: The airport config in OSX leaves a lot to be desired. We use WPA2 encryption with PEAP/EAP-GTC authentication. The airport driver is always wanting to cache passwords and since they are based on RSA SecureIDs...this is not a good idea.

The work around ended up being to just always connect using 'Join Other Network' and entering all info manually each time. After the recent airport update from Apple though, our mac clients are being disconnected with the following error:

"802.1X is unable to authenticate. It is possible that the configuration you have provided is invalid. If you are unsure about what configuration to connect with, check with your network administrator.
( Error: 1 on port en1 )"

right in the middle of an already authenticated, working session. Like, hours into it, but at random. This happens anywhere from 1-2 hours in to 8+.

Reply

Answer 5

djcerk

Level 1

9 points

Nov 18, 2008 10:48 AM in response to HozzMidnight

If all else fails, with "Error 1 on port en1" try this..

Delete the system wide network settings:
Go to Macintosh HD/Library/Preferences
- Drag SystemConfigurations to the trash, empty trash, restart.
Recreate or try to join the network again. This worked for me.

Reply

Answer 6

Jan 13, 2011 2:24 PM in response to djcerk

djcerk,

I created an account just to thank you for the advice on what to do if "all else fails."

I have had numerous issues with the WPA2 Enterprise security at Texas Tech University, and after spending several hours in class and at the library trying every tutorial I could find on Google, not to mention TTU's IT site, I deleted the preferences like you said, restarted my computer, and entered the server info manually and voila!

*_For everyone else_: If you have tried "everything" and are beginning to think connecting to your network through WPA2 Enterprise is hopeless, take the advice of the gentleman above me and your problems will be solved.*

Reply

Answer 7

Feb 8, 2013 12:28 PM in response to HozzMidnight

I just wanted to thank you properly. I just tried this after trying to delete my cached password and login (remembered networks) and I was still getting this error message:

"802.1X is unable to authenticate. It is possible that the configuration you have provided is invalid. If you are unsure about what configuration to connect with, check with your network administrator. "

I'm still running 10.5.8 on my 2009 MBP so I'm pretty behind the times but I bought this laptop for college and don't plan on buying one until I'm completely out-moded. It wasn't a problem until campus internet switched from an authentication webpage with our student id and password to a WAP2 token username/password system. The last week I've been completely locked out of our Wi-Fi network and "joining other network" then entering in my info worked and made my paper research finally possible. So thank you! Also this means I should probably update to Mountain Lion huh?

Reply