802.1x Wireless Logon Failure

[rsterner]

The Problem: New user enters Active Directory credentials to login via 802.1x WiFi. The yellow indicator stays on for 2 minutes, then the screen shakes indicating a failed authentication. If I immediately press the Return key, the login will proceed normally and login in about 20 seconds.

The Details: MacBook Pro (various models from past 2 years), Mac OS 10.8.4, JSS 8.71, configuration profile pushed from JSS, joined to Active Directory Domain, Deep Freeze in frozen state (same problem when thawed). Mobile accounts Off. Logon works normally with wired Ethernet. This problem appeared after upgrading from Mac OS 10.7.x to 10.8.4.

Looking at the logs, we found the following entries on the failed login:

2013/08/27 15:28:47.719009 EAP Request Identity
2013/08/27 15:28:47.719027 Acquired: cannot prompt for missing user name
2013/08/27 15:28:47.719150 set_key 0/0
2013/08/27 15:28:47.719193 Supplicant (main) status: state=Held

It repeats that over and over in the log until it gives up. We cleared the log, tried again, and the next time it worked, getting:

2013/08/27 15:10:53.805074 EAP Request Identity
2013/08/27 15:10:53.805099 EAP Response Identity steve.jones
2013/08/27 15:10:53.805122 Transmit Packet Size 20
Ether packet: dest 0:24:6c:e3:43:60 source 10:40:f3:ec:65:d2 type 0x888e
EAPOL: proto version 0x1 type EAP Packet (0) length 16
EAP Response (2): Identifier 1 Length 16
Identity (1)
length 16 - sizeof(*rd_p) 5 = 11
0000 73 74 65 76 65 2e 6a 6f 6e 65 73 steve.jones 2013/08/27 15:10:53.805192 Supplicant (main) status: state=Acquired

We are now looking for a cause.

[AndyBeaver]

Are you using a System Profile with an authenticated user along with your Login Window profile?

[ooshnoo]

We had similar issues last year.

A login window 802.1x wifi profile created by the JSS did not work, but one with the same settings created by OS Xs Profile Manager did.

I opened a case with Apple Enterprise support and they had be send both profiles to them. They looked at the XML in the profiles and determined the the one created by the JSS was written with incorrect XML.

This may not pertain to you, but just some food for thought. Maybe check out the code and compare if you want go down that road.

[rsterner]

@AndyBeaver:
I am using a Computer Level Profile created on the JSS. No other profiles are present. This profile works OK on OS 10.7.x, and only appeared when I updated to 10.8.4.

Rick