hotspot gateway authentication problem ???

RouterOS General
1

Hi all,
I try to configure hotspot gateway using 2 authetication methods

  • http-chap for office users ( using Microsoft IAS ) so they can use their domain accounts for hotspot authentication
  • ssl for guests
    -------->It’s ok.
  • I import certificate ( generated by openssl ) and select SSL cerfiticate on Hotspot server profile
    -------->only SSL authentication is successful ( that means i can use hotspot local account DB for logging in ), can NOT use http-chap ( can not use domain account for logging in ). In log file, there’re 2 entries “trying to log in by https” & “login failed: invalid username or password” even if I use radius user account
  • enable only http-chap, disable ssl ------> it’s ok
  • enable only ssl, disable http-chap ------> it’s ok

Is there any mistake ???

2

Where domain accounts are stored for HTTP-CHAP users ?

MikroTik HotSpot is working in the way, that firstly is contacted local user database, then remote (RADIUS server).

So, it could mean,
trying to log in by https" & "login failed: invalid username or password.
That user has tried to login by HTTPs and local database (not remote) existing username was used for authorization

3

The user is not duplicated in RADIUS & local DB. I test again and I can use https & http-chap method together when enable PAP in IAS authentication but the PAP method is disable on HotSpot gateway :frowning: . So why they can talk together /w PAP ??