IBM Verify

IBM Verify

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  Ibm radius server

    Posted Fri January 17, 2025 09:27 AM
    Edited by Eric Hoffmann Fri January 17, 2025 09:27 AM

    Hi, i am trying to use the RADIUS server for MFA authentication. My problem is that if I test it with radclient, everything works fine. However, when I try to connect using a client service that should interact with the RADIUS server, I encounter the following error on the verify server:

    Error:
    The system failed to authenticate user "ehoffmann" because of "INVALID_CREDS"

    What am I doing wrong? Below are the requests I sent from the RADIUS server, shown with dummy values and not the real ones:

    Example RADIUS IP: 1.1.1.1
    Example Client IP: 2.2.2.2

    Logs:
    with radclient:

    IA: 0x678a5904: 0x7f99bcd2f640: Client for packet = 'Forcepoint-SMC' from ::ffff:1.1.1.1
    IA: 0x678a5904: 0x7f99bcd2f640: Incoming Radius Packet AccessRequest I=0x71 L=0x43
    IA: 0x678a5904: 0x7f99bcd2f640:    'Message-Authenticator'='b0bb5d11e29bfd4cf8aab918ea40b502'
    IA: 0x678a5904: 0x7f99bcd2f640:    'User-Name'='test'
    IA: 0x678a5904: 0x7f99bcd2f640:    'User-Password'='********'
    IA: 0x678a5904: 0x7f99bcd2f640: ibm_auth_hdl_acquire(lang=(null)): Enter


    with Client software:

    IA: 0x678a5a8d: 0x7fcdd5336640: Client for packet = 'Forcepoint-SMC' from ::ffff:2.2.2.2
    IA: 0x678a5a8d: 0x7fcdd5336640: Incoming Radius Packet AccessRequest I=0x58 L=0x4f
    IA: 0x678a5a8d: 0x7fcdd5336640:    'NAS-IP-Address'='2.2.2.2'
    IA: 0x678a5a8d: 0x7fcdd5336640:    'NAS-Port'='0x1'
    IA: 0x678a5a8d: 0x7fcdd5336640:    'User-Name'='test'
    IA: 0x678a5a8d: 0x7fcdd5336640:    'User-Password'='********'
    IA: 0x678a5a8d: 0x7fcdd5336640:    'Message-Authenticator'='53f02c2bf8d81c174ee9a783dc8d



    ------------------------------
    Eric Hoffmann
    ------------------------------



  • 2.  RE: Ibm radius server

    Posted Mon January 20, 2025 03:15 AM

    Hi Eric,

    I'm assuming you're setup is using the IBM Security Gateway for RADIUS and integrates with Verify Access, right?

    Please share details on your configuration, specifically on how authentication is configured for that RADIUS client. See this link: https://www.ibm.com/docs/en/security-verify?topic=radius-configuring-security-verify-gateway-server

    Please isolate the problem e.g. with a setting of auth_method to "password" (i.e. password only).

    Also mind the configuration of use-local-pwd-check if you're running the Gateway on Windows.

    The Gateway for RADIUS was originally only supported for Verify SaaS, the support for Verify Access that came later on. But the documentation on www.ibm.com/docs on the Gateway's config is not up to date with that ISVA integration.

    Just to make sure: did you carefully follow the steps as described over here: https://www.ibm.com/docs/en/sva/11.0.0?topic=configuring-verify-identity-gateway. This is needed to make ISVA understand what the Gateway is sending. What do you see at ISVA's end looking at the runtime trace file?

    Hope this helps,

    Peter.



    ------------------------------
    Peter Volckaert
    Technical Subject Matter Expert
    Authentication and Access
    IBM Security
    ------------------------------



  • 3.  RE: Ibm radius server

    Posted Mon January 20, 2025 08:36 AM
    Edited by Eric Hoffmann Mon January 20, 2025 08:37 AM

    Hi Peter,

    Thank you for your answer and help. Here is my configuration file:

    {
        "address": "::",
        "port": 1812,

        "trace-file": "/tmp/ibm-auth-api.log",
        "trace-rollover": 12697600,

        "ibm-auth-api": {
            "client-id": "********",
            "obf-client-secret": "**********", /* See IbmRadius -obf "the-secret" */
            "protocol": "https",
            "host": "*****.verify.ibm.com",
            "port": 443,
            "max-handles": 16
        },
        "clients": [
            {
                "name": "Forcepoint-SMC",
                "address": "2.2.2.2",
                "secret": "Passw0rd",
                "auth-method": "password",
                "use-external-ldap": false,
                "reject-on-missing-auth-method": true,
                "device-prompt": "A push notification has been sent to your device: [%D].",
                "poll-device": true,
                "poll-timeout": 60
            }
        ]
    }

    I still have the same error with only password set.

    I am trying to set it up with Verify SaaS as you did in your guide. First, thank you for the amazing tutorial and video recording on YouTube-it really helped.

    I installed the Gateway on Linux using the Docker containers.

    However, I didn't complete the last step you mentioned, and I don't really understand it exactly. Can you please tell me where the Wizards are located?

    On the Gateway server, I am running the following command:

    echo "User-Name = test, User-Password = example-password" | radclient -x -s 1.1.1.1:1812 auth Passw0rd

    (Here, 1.1.1.1 is the example IP for the Gateway server.) When I run this with the configuration and switch to 2.2.2.2 for 1.1.1.1, it works. However, if I set it up with 2.2.2.2 (example for the Client server IP), it does not work anymore.

    I configured PHP as the protocol for communication, as it seems to be the only supported one, as far as I know.

    Thanks for your help.



    ------------------------------
    Eric Hoffmann
    ------------------------------



  • 4.  RE: Ibm radius server

    Posted Mon January 20, 2025 09:52 AM

    Hi, the wizards I'm talking about are the configuration wizards in Verify Access that need to run to make Verify Access understand the API calls coming from the Verify Gateway for Radius. Referring to this link:  https://www.ibm.com/docs/en/sva/11.0.0?topic=configuring-verify-identity-gateway :

    As long as these wizards have not ran, nothing is going to work - at least when you're using Verify Access for the integration. So I wonder what/how you managed to make that radclient call work through the Gateway. Or were you using Verify SaaS there?

    What does the trace file of the Gateway say? Do you see the Radius calls coming in when connecting via the RADIUS client? And when you do the radclient call from the Gateway server, do you see an "authentication successful" message?

    Further isolate the problem by running the radclient (or another Radius test client app) from the Radius client's server (2.2.2.2 as you call it). 

    Just to make sure: did you restart the Gateway after changing the configuration (of the client IP)?

    Kind regards, 

    Peter



    ------------------------------
    Peter Volckaert
    Technical Subject Matter Expert
    Authentication and Access
    IBM Security
    ------------------------------