EAP-FAST, ACS, CSSC, AD password changes

[toddsandery]

We have been using 802.1x machine and user authentication via MS built-in supplicant (PEAP, MSCHAP-v2) and MS IAS (radius) backend on a wired network for about a year.

We recently migrated our 802.1x platform to CSSC 4.2 and ACS 4.1.

I soon discovered that when MS AD informs the user that their password requires changing (after 30 days due to GP), the user happily changes their password, and soon after, CSSC authentication fails. A reboot and subsequent Logon resolves the problem.

It seems CSSC has cached the initial logon details and has not updated itself when the password change took place?

Has anybody else experienced this problem and discovered a solution?

[#2]

Does this happen everytime you logon with new password?

[toddsandery]

Well, whenever a password change is required by AD (once every 30 days). ACS then reports "Invalid Protocol Data" when the next 802.1x reauthentication occurs soon after the AD password change. The remote agent log shows the authentication as successful. Rebooting the PC resolves the issue for another 30 days but this is not acceptable.

I'm using ACS 4.1.1.23.p5 CSSC 4.2.0.6187 and CTA 2.1.3.0