problems with hints file

[Phil Mayers]

wekz wrote:
> Hi all,
> 
> I use freeradius1.1.1 + ldap. And peap or eap-tls for authorization.
> 
> I've been trying to use hints.file for changing the User-Name. When a 
> laptop user which is in a domain tries to do a peap authentication, 
> windows sends a User-Name that follows this pattern (at least the ones 
> I've seen):
>                    
>                                              DOMAIN\5c\5cLOGIN
> 
> I'm trying to catch up the LOGIN name so the radius can perform a search 
> in ldap.
> 
> I've modify hints.file including this line:
> 
>                       DEFAULT User-Name =~ "^([^\\]+)\\5c\\5c([^\\]+)"
>                                       User-Name := "%{2}"

I assume you didn't mean "5c" but the body of your mail appears to have 
been corrupted along the way.

> 
> 
> The problem is that this rule matches but it changes the User-Name for 
> an empty string.

I believe that should be:

DEFAULT User-Name =~ "^([^\\]+)\\\\([^\\]+)"
         User-Name = `%{2}`

HOWEVER - you should almost certainly be using the "realm" module to do 
this. The default config has "realm ntdomain {" ...config lines defined. 
If you put this in "authorize" like so:

authorize {
   preprocess
   ntdomain
   # other modules
}

...then add this in proxy.conf:

realm MYDOMAIN {
   type = radius
   authhost = LOCAL
   accthost = LOCAL
   strip
}

...you can then use the following in e.g. the ldap config:

  ldap {
    # other config

    # NOTE: the expansion means "Stripped-User-Name OR User-Name"
    filter = "(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})"

    # other config
  }