NPS extension - RADIUS attributes of Network policy

Question

Problem : The NPS server is not setting the RADIUS attributes if radius challenge-response is used by my custom NPS extension to additionally verify the user. RADIUS auth protocol used is PAP.

My logic for challenge verification :

1. During repAuthorization extension point, rcAccessChallenge response code will be set along with a state.
2. During the next repAuthentication point, based on the state, challenge value will be verified and rcAccessAccept response code will be set.

As per Azure MFA NPS extension documentation when text based MFA is used, RADIUS attributes won't be forwarded.

Questions

1. Is the behavior of NPS server or is there any workaround to achieve this or any development going to overcome this behavior ?
2. Also I can see a constant definition "EnforceNetworkPolicyForPAPBasedChallengeResponse" at Authif.h header which seems more like a registry value. Does this has anything to do with the problem or requirement ?

Answer 1

Hi ,

Thanks for your posting here.

I did not find any Microsoft official document talking about this behavior. If you want to know deeper, I would suggest you contact Microsoft Customer Support and Services where more in-depth investigation can be done so that you would get a more satisfying explanation and solution to this question.

Here is the link:

https://support.microsoft.com/en-us/gp/customer-service-phone-numbers

Best Regards,

Candy