Re: OR-type authentication

Phil Mayers <p.mayers@imperial.ac.uk> · Fri, 18 Aug 2006 15:25:19 +0100

Héctor Alberto Ortiz Barrón wrote:

My radiusd.conf file
...
modules {
       mschap certificate_userpass {
       }
       mschap winlogon {
       }
       $INCLUDE  ${confdir}/eap.conf
       $INCLUDE  ${confdir}/sql.conf
...
instantiate {
       exec
       certificate_userpass
       winlogon
}
...
authorize {
       redundant {
               sql
               winlogon
               certificate_userpass
       }
       eap
}
...
authenticate {
       Auth-Type MS-CHAP {
               redundant {
                               certificate_userpass
                               winlogon
               }
       }
       eap
}
...

Using this configuration, I am able to connect to the network using a 

That configuration looks seriously, seriously broken. Why have you 

defined >1 mschap module and called one "certificate_userpass" when the 

mschap module can only handle ms-chap? Why are you playing odd games 

with redundant copies of modules in odd places? Why are you putting 

modules in the instantiate section that don't need it?

certificate on the client computer or providing a user name and password 

which are checked against the mysql database, but I can't authenticate 

against the AD. If I comment out the part regarding sql from the 

I'm not surprised.

authorize section and do like this in the authenticate section (inverse 

order):

authenticate {
       Auth-Type MS-CHAP {
               redundant {
                               winlogon
                certificate
               }
       }
       eap
}

I can now authenticate against the AD and using certificates, but not 

using the database.

Question:

What changes do I require in order to be able to grant access taking 

into account the three methods?

Perhaps you could be more specific about what you're trying to do. You 

cannot authenticate a single user against two sources of info - how 

would that even work?

Are you saying that you have some users in SQL and some users in a 

domain controller, and want both to work?

I take it this is for 802.1x authentication?

You almost certainly want something a bit more like this:

modules {
  mschap {
    # we will override use of this on a per-user basis for users in SQL
    ntlm_auth = whatever
  }

$INCLUDE  ${confdir}/eap.conf
$INCLUDE  ${confdir}/sql.conf
}

authorize {
  preprocess
  sql
  mschap
  eap
}

authenticate {
  Auth-Type MS-CHAP {
    mschap
  }
  eap
}

...and for your users in SQL, have this:

 id | username |   attribute           | op |  value
----+----------+-----------------------+----+----------
  1 | foo      | User-Password         | := | bar
  2 | foo      | MS-CHAP-Use-NTLM-Auth | := | 0