Drive share with logs
https://drive.google.com/drive/folders/0B-094aXvU4bsRi1RMEZyQ1pDeW8?usp=sharing


It looks like the 802.1X Device policy is not applying. 

See the log entries in net.log 

2016-10-19T14:00:37.668681-07:00 INFO shill[2968]: [INFO:ethernet.cc(415)] EAP Service lacks 802.1X credentials; not doing EAP authentication.
2016-10-19T14:00:41.463305-07:00 INFO dhcpcd[23184]: eth0: sending REQUEST (xid 0x45e3fec4), next in 8.7 seconds
2016-10-19T14:00:42.268433-07:00 ERR dhcpcd[23184]: eth0: DHCP lease expired
2016-10-19T14:00:42.272645-07:00 INFO dhcpcd[23184]: status changed to Release
2016-10-19T14:00:42.273217-07:00 INFO dhcpcd[23184]: status changed to Discover
2016-10-19T14:00:42.273248-07:00 INFO dhcpcd[23184]: eth0: soliciting a DHCP lease
2016-10-19T14:00:42.273264-07:00 INFO dhcpcd[23184]: eth0: sending DISCOVER (xid 0x3c8e641c), next in 3.2 seconds


How can we troubleshoot this for kiosk mode?

Is there a way to manually configure/troubleshoot the supplicant in the DEV console in kiosk with  ctrl-alt-F2

Note: We have a customer who is trying to deploy many Chromebases Kiosk and provide connectivity via Ethernet 802.1x. 

Customer confirms they can apply device network policy for Ethenet/802.1x  and can connect when they sign-in a user. It does not work in Public Session or Kiosk mode.

I tested this again and it appears that only the USER Network policy works.

TEST1: DEVICE Policy for Network->Ethernet 
Result= FAIL

Chrome://policy shows Warning on the device ONC "some settings are not compliant with ONC and will not be applied"


Admin Console
1) Configure only a Network->Ethernet 802.1x/EAP-TLS policy applied to DEVICS.
2) Disable all other Network-> Ethernet policies.
3) Delete previous profile for user1@

Chromebook
4) Sign-in, verify in chrome://policy only the DEVICE ONC has Network->Ethernet 802.1x/EAP-TLS configuration
5) Connect to Wifi or non secure ethernet to install a System/device wide certificate. 
6) Disable WiFi, Logout
7) Connect ethernet to port that requires 802.1X, see that it cannot authenticate, and connect at the sign-in screen
8) Log-in
9) Ethernet authentication FAILS 
10)Error log on switch/authenticator %AUTHMGR-7-RESULT:Exhausted all authentication methods for client  ... Authorization failed for client (9410.3eb8.53b4), 



TEST2: User Policy for Network->Ethernet
Result= Success

Admin Console
1) Configure only a Network->Ethernet 802.1x/EAP-TLS policy applied to users.
...
same steps 2-8 above
...
9) Ethernet authentication successful   
10) Error log on switch/authenticator shows shows %AUTHMGR-7-RESULT: Authentication successful for client (9410.3eb8.53b4) 

Please don't use Infra > Labs for these requests.

Raising the priority to 2 as there is a commitment to test and push EAP-TLS wired security configuration by Dec/Jan.

Can you please provide an update on progress to this bug so I can relay it to my leaders?

Can you please provide an update on progress to this bug so I can relay it to my leaders?

Please provide an update to this so that I can update my teams on when this should be working and be able to test this out.  

aluong@ - who is the right owner for this?

Can we please get an update on when this will be worked on?  

dskaram@ as FYI 

Hello,

Please provide an update to this

Hello,

Please provide an update with timeline so I can give that information to my leadership.