Level 1

22 points

LEAP authentication from iPhone 2.0

If someone knows how to do this can you please post instructions. I could not figure out how; I was expecting to be able to do it in a fashion similar to how it's done under Leopard or even Tiger(the workaround).

thanks

G4, Mac OS X (10.4.10)

Posted on Jul 14, 2008 7:12 AM

75 replies

Jul 25, 2008 10:31 AM in response to zsurfsup

In this method are you connecting to a network that has Windows domain authentication? If so, how do you specify the domain? I am guessing that in the username field I should put DOMAIN\USERNAME to send the domain information. On my laptop, there is a separate field for supplying the Windows domain.

Jul 25, 2008 10:34 AM in response to zsurfsup

Thanks zsurfsup.

I have a 3G, so no 2.0 update was necessary. I did reset the Network Settings. The SSID and password should be correct. I get a good WiFi signal in my office.

Note that I did install a profile with WEP Enterprise and LEAP, but when I tried to connect manually using WPA Enterprise it didn't work.

Our company is high-tech and they are paranoid about security, so I wouldn't be surprised if we had a restricted MAC address list. It's common I think to allow only registered devices to connect, even if you use the correct username/password.

A question: my laptop LEAP config has username/domain/password (we use Windoze) so I'm wondering how to use the correct username, because the Apple config has no field for domain. Would the username be "domain\username"?

Jul 25, 2008 10:41 AM in response to zsurfsup

zsurfsup,

Just to confirm - you did create a profile using the Apple enterprise config utility, right? I think you have to do this to get LEAP support.

zsurfsup Author

Level 1

22 points

Jul 25, 2008 10:47 AM in response to Frank Malloy

Yes it's Windows domain authentication so in our regular login we of course have to specify
domain\username and then password.
In the OS X Tiger workaround for LEAP using WEP Enterprise you do not need the Domain, it's just <username/password>. See link: http://docs.info.apple.com/article.html?artnum=302399
BTW, when I upgraded my laptop to Leopard I did not have to change any of these settings.

The iPhone is the same way. We did not have to use the domain. Just your username and password.

Frank you are probably right that the server side could be configured to only allow recognized devices via MAC addresses. However, I am at a Government facility which is very secure. So either our assumption is wrong or my facility's security is lacking. Also, can you try removing the WEP/LEAP profile you installed and try WPA again?

Message was edited by: zsurfsup

zsurfsup Author

Level 1

22 points

Jul 25, 2008 10:52 AM in response to Frank Malloy

Frank, I did not create any kind of profile. In fact, excuse my naivety, but I'm not even sure what you guys are talking about. I will have to google it. I assume its some kind up support app for the iPhone 2.0 update, dealing with enterprise?

Jul 25, 2008 10:58 AM in response to zsurfsup

You didn't create a profile? But the default iPhone does not allow you to configure LEAP without using the Web-based Apple Configuration Utility, which creates network profiles which implements LEAP. You notice that you can do WEP/WPA Personal or Enterprise, but there are no LEAP options.

How did you get on a LEAP network without creating a profile? Are you sure your company is using LEAP?

zsurfsup Author

Level 1

22 points

Jul 25, 2008 11:27 AM in response to Frank Malloy

I did not create a profile. I did not even download that utility. Thats the whole reason the instructions say to use WPA Enterprise instead of LEAP because there is no LEAP option as you point out.

infobhan, if you are still listening can you comment on what you did concerning this?

I just used the WPA Enterprise on the iPhone similarly to the way we used the WEP Enterprise under OS X Tiger. That's why I opened this thread because, out of ignorance I guess, I thought I would be able to do it like we did on the laptops. So when infobhan posted his instructions they made sense to us and we just followed them. I am 99.9% sure we are using LEAP Authentication (I always leave room for error). Do you know of a way to verify from a client?

Jul 25, 2008 11:41 AM in response to zsurfsup

Hi zsurfsup,

I am trying to understand this (I am not a networking guy), and to me, WPA and WEP/LEAP are two different protocols:

http://www.networkworld.com/research/2003/0331wpa.html?page=1

So if you're getting LEAP to work with WPA I have no idea how or why you it is working for you!

I checked my Windoze laptop client (Intel PROset/Wireless) and it says:

Enterprise Security (bubble is checked)
Network Authentication: Open
Data Encryption: WEP (it's either that, or CKIP - no WPA option)
Enable 802.1x: (Box is checked)
Authentication Type: LEAP
LEAP User: Use the Windows logon username and password

What I read (look at page 1 of the thread) is that to enable LEAP, you have to download the iPhone Configuration Web Utility, create a LEAP profile, download it to the phone, and install it, which I did. No go.

I tried your sequence with WPA Enterprise, and it doesn't work either. I see the network name under the WiFi panel, and it shows a signal strength. I just can't connect to it.

I'll try the whole WPA sequence again, but I can't see how you can use WPA on a LEAP network and it works.

Can a networking guru help out here?

zsurfsup Author

Level 1

22 points

Jul 25, 2008 12:20 PM in response to Frank Malloy

I too am not a network engineer. I am a software engineer with no specialization in networking. My understanding was LEAP is the authentication protocol that sits on top of things like WEP and WPA. But I am not sure so a network guru could be of great help. In fact I just read that LEAP doesn't work with WPA.

Also, remember all of my experience with this has been on Macs and OS X and using LEAP under OS X Tiger was a know problem and Apple published the LEAP 'fix' I linked to earlier on. Then I just tried the same type of thing on the iPhone with WPA Enterprise and viola, it worked. So, did my network get 'switched' to WPA and I don't know it. Is that even possible? Is infobhan not on a LEAP Authenticated network as well? I can't answer. All that I know is I:
Downloaded iPhone 2.0
Did not use iPhone Configuration Web Utility.
Reset my iPhone network settings.
Used WPA Enterprise with SSID, username and password in their appropriate text entry boxes.
Successfully logged onto what I am very certain is a LEAP Authenticated network.

Several other iPhone users in my area did the same thing and it sounds like infobhan's folks did the exact same thing, all successfully.

Hopefully someone smarter then us on the topic can clarify things.

Message was edited by: zsurfsup

Message was edited by: zsurfsup

Message was edited by: zsurfsup

Jul 25, 2008 12:26 PM in response to zsurfsup

Thanks zsurfsup!

I am now reading that you can use LEAP on top of WPA. But, I checked my client settings and it's WPA with LEAP. I configured it the same way thru the profile mechanism and it doesn't work.

I'm guessing you have WPA with LEAP. But I am still puzzled that you achieved this without having to create a profile, because you noticed that there is no LEAP/PEAP/EAP-FAST, etc choices in the default iPhone connection. That is the interesting point.

I tried many different things, and none work, so I have to conclude that my network is using a restricted MAC access list, until I can find out otherwise...

Jul 25, 2008 1:08 PM in response to Frank Malloy

Sorry, I meant WEP with LEAP, not WPA.

infobhan

Level 1

19 points

Jul 26, 2008 8:50 AM in response to Frank Malloy

LEAP definitely works with 10.4. In fact, if anything, it got trickier with 10.5. As I recall, I just selected the SSID from the airport menu and got prompted for a login; a drop-down menu on the dialog had LEAP.

infobhan

Level 1

19 points

Jul 26, 2008 8:51 AM in response to zsurfsup

I did not create a profile either. I just used the WPA Enterprise feature and it somehow figured out it was LEAP.

Jul 26, 2008 10:34 AM in response to infobhan

Thanks infobhan!

I see the LEAP option in my PowerBook now - you are right. I will take it into work and see if I can connect with that. If I cannot, they probably use restricted MAC addresses. If it does connect, it's something with the iPhone. I see the network and a signal, but when I try to connect it just says "Unable to connect" right away.

I tried WPA Enterprise with and without a LEAP profile, and same with WAP. Neither worked.

zsurfsup Author

Level 1

22 points

Jul 26, 2008 1:39 PM in response to Frank Malloy

Frank, Please let us know how it works out for you.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

LEAP authentication from iPhone 2.0