<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<TITLE>Message</TITLE>
<META content="MSHTML 6.00.2900.2722" name=GENERATOR></HEAD>
<BODY text=#000000 bgColor=#ffffff>
<DIV><SPAN class=372003409-02092005><FONT face="Courier New" color=#0000ff
size=2>Hi,</FONT></SPAN></DIV>
<DIV><SPAN class=372003409-02092005><FONT face="Courier New" color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=372003409-02092005><FONT face="Courier New" color=#0000ff
size=2>I use Funk Odyssey. It works really well with EAP-TTLS/PAP.
We use an LDAP connection to our AD Global Catalogs to just query the validity
of the user credentials and obtain the memberOf attributes.</FONT></SPAN></DIV>
<DIV><SPAN class=372003409-02092005><FONT face="Courier New" color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=372003409-02092005><FONT face="Courier New" color=#0000ff
size=2>The Odyssey GINA module seems pretty reliable.</FONT></SPAN></DIV>
<DIV><SPAN class=372003409-02092005><FONT face="Courier New" color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=372003409-02092005><FONT face="Courier New" color=#0000ff
size=2>Rgds,</FONT></SPAN></DIV>
<DIV><SPAN class=372003409-02092005><FONT face="Courier New" color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=372003409-02092005><FONT face="Courier New" color=#0000ff
size=2>Guy</FONT></SPAN></DIV>
<BLOCKQUOTE dir=ltr
style="PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #0000ff 2px solid; MARGIN-RIGHT: 0px">
<DIV></DIV>
<DIV class=OutlookMessageHeader lang=en-us dir=ltr align=left><FONT
face=Tahoma size=2>-----Original Message-----<BR><B>From:</B>
freeradius-users-bounces@lists.freeradius.org
[mailto:freeradius-users-bounces@lists.freeradius.org] <B>On Behalf Of
</B>Jérémy Cluzel<BR><B>Sent:</B> 02 September 2005 00:37<BR><B>To:</B>
freeradius-users@lists.freeradius.org<BR><B>Subject:</B> RE: Windows Client
Authentification bevore Domain logon<BR><BR></FONT></DIV>Hi Guy,<BR><BR>Do you
know working supplicants with a GINA module ? aegis ? secureW2
?<BR><BR>Regards,<BR><BR>Jeremy<BR><BR><A class=moz-txt-link-abbreviated
href="mailto:freeradius-users-request@lists.freeradius.org">freeradius-users-request@lists.freeradius.org</A>
a écrit :
<BLOCKQUOTE cite=mid200509012112.j81L6axm007884@list4.xs4all.nl type="cite"><PRE wrap="">Date: Thu, 1 Sep 2005 17:10:14 +0100
From: "Guy Davies" <A class=moz-txt-link-rfc2396E href="mailto:Guy.Davies@telindus.co.uk"><Guy.Davies@telindus.co.uk></A>
Subject: RE: Windows Client Authentification bevore Domain logon
To: "FreeRadius users mailing list"
<A class=moz-txt-link-rfc2396E href="mailto:freeradius-users@lists.freeradius.org"><freeradius-users@lists.freeradius.org></A>
Message-ID:
<A class=moz-txt-link-rfc2396E href="mailto:A00F4E8D8C7E8847A8ABFFE22F48033701B3692A@tuk1mx1.telindus.intra"><A00F4E8D8C7E8847A8ABFFE22F48033701B3692A@tuk1mx1.telindus.intra></A>
Content-Type: text/plain; charset="iso-8859-1"
Hi Marc,
The only way to do this with the supplicant included with XP is to use machine auth. This must use the same method used by the individual (i.e. EAP-TLS or PEAP/MS-CHAPv2).
There is a checkbox that says something like "Use machine credentials if available". Check that and the machine will authenticate before the user. Once the user authenticates, the machine auth is killed and the user's auth is used. This requires that the machine has either a PEAP/MS-CHAPv2 username/password or an EAP-TLS certificate. These are stored in AD so you have to backoff your request to AD. If you want to do that for PEAP/MS-CHAPv2, you'll need NTLM access to the AD server, LDAP won't do because it can't get the cleartext password (unless it is replicated to a non-standard attribute).
A better method, in my experience, is to use a supplicant with a GINA module. That stops the windows login process immediately after the user has entered the credentials, takes the user's credentials and uses them to login to the network, then it returns control to the windows login process. This doesn't require any authentication of the machine.
Regards,
Guy
</PRE>
<BLOCKQUOTE type="cite"><PRE wrap="">-----Original Message-----
From: <A class=moz-txt-link-abbreviated href="mailto:freeradius-users-bounces@lists.freeradius.org">freeradius-users-bounces@lists.freeradius.org</A>
[<A class=moz-txt-link-freetext href="mailto:freeradius-users-bounces@lists.freeradius.org">mailto:freeradius-users-bounces@lists.freeradius.org</A>] On
Behalf Of Marc-Henri Boisis-delavaud
Sent: 01 September 2005 15:19
To: FreeRadius users mailing list
Subject: Re: Windows Client Authentification bevore Domain logon
Le 31 août 05 à 18:53, Alan DeKok a écrit :
</PRE>
<BLOCKQUOTE type="cite"><PRE wrap="">=?ISO-8859-1?Q?J=E9r=E9my_Cluzel?= <A class=moz-txt-link-rfc2396E href="mailto:j.cluzel@online.fr"><j.cluzel@online.fr></A> wrote:
</PRE>
<BLOCKQUOTE type="cite"><PRE wrap="">Sorry, but I didn't find any references of this OID in the
creation scripts in the "scripts" directory (Ca.all, CA.certs...).
The only OID added seem to be 1.3.6.1.5.5.7.3.1 and
1.3.6.1.5.5.7.3.2 (in "xpextensions").
Is there any way to do this without patching openssl (like
explained there
</PRE></BLOCKQUOTE></BLOCKQUOTE><PRE wrap=""><A class=moz-txt-link-freetext href="http://lists.cistron.nl/pipermail/freeradius-users/">http://lists.cistron.nl/pipermail/freeradius-users/</A>
</PRE>
<BLOCKQUOTE type="cite">
<BLOCKQUOTE type="cite"><PRE wrap="">2004-July/034141.html) ?
</PRE></BLOCKQUOTE><PRE wrap=""> You can use that OID just like the other ones.
Alan DeKok.
-
List info/subscribe/unsubscribe? See
</PRE></BLOCKQUOTE><PRE wrap=""><A class=moz-txt-link-freetext href="http://www.freeradius.org/list/">http://www.freeradius.org/list/</A>
</PRE>
<BLOCKQUOTE type="cite"><PRE wrap="">users.html
</PRE></BLOCKQUOTE><PRE wrap="">Can you explain how we can activate 802.1x authentification before
logon on xp. And what are the prerequisites ?
Marc
-
List info/subscribe/unsubscribe? See
<A class=moz-txt-link-freetext href="http://www.freeradius.org/list/users.html">http://www.freeradius.org/list/users.html</A>
</PRE></BLOCKQUOTE><PRE wrap=""><!---->
This e-mail is private and may be confidential and is for the intended recipient only. If misdirected, please notify us by telephone and confirm that it has been deleted from your system and any copies destroyed. If you are not the intended recipient you are strictly prohibited from using, printing, copying, distributing or disseminating this e-mail or any information contained in it. We use reasonable endeavours to virus scan all e-mails leaving the Company but no warranty is given that this e-mail and any attachments are virus free. You should undertake your own virus checking. The right to monitor e-mail communications through our network is reserved by us. </PRE></BLOCKQUOTE></BLOCKQUOTE></BODY><!--[object_id=#telindus.co.uk#]--><FONT face=Tahoma size=2><FONT color=#0000ff><FONT size=2>
<P>This e-mail is private and may be confidential and is for the intended recipient only. If misdirected, please notify us by telephone and confirm that it has been deleted from your system and any copies destroyed. If you are not the intended recipient you are strictly prohibited from using, printing, copying, distributing or disseminating this e-mail or any information contained in it. We use reasonable endeavours to virus scan all e-mails leaving the Company but no warranty is given that this e-mail and any attachments are virus free. You should undertake your own virus checking. The right to monitor e-mail communications through our network is reserved by us. </P></FONT></FONT></FONT></HTML>