Rejected authentication requests

This is one diagnosed by Hans Litteck from the University of London.

He'd noticed that attempts to authenticate a test user were failing and worked with Camden Council to figure it out. Thanks to all involved.

The exective summary is that Microsoft NPS was configured to reject any request that wasn't formatted like:

Called-Station-ID =~ :govroam$

i.e. the Called-Station-ID should have a suffix of ':govroam' after the address of the device.

To quote Hans:

RFC

Further to this Hans has looked into the attribute filters and determined that NPS should be configured not to filter out the following from a proxied request:

NAS-IP-Address
NAS-Identifier
NAS-Port
NAS-Port-Type

…