<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7651.59">
<TITLE>Re: Splitting the password field in freeRADIUS</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/rtf format -->
<P><FONT SIZE=2 FACE="Courier New">Dan Geist explained what it was I am trying to do. His suggestion is the way I will look, to use a perl module to split the authentication. </FONT></P>
<P><FONT SIZE=2 FACE="Courier New">Time for some ASCII Art (bad)</FONT>
</P>
<BR>
<P><FONT SIZE=2 FACE="Courier New">NAS ---> FR</FONT>
</P>
<P><FONT SIZE=2 FACE="Courier New">(this field passes the password via RADIUS/PAP, and is the securID tokencode + kerberos pwd.)</FONT>
</P>
<P><FONT SIZE=2 FACE="Courier New">( ex: user:jdoe pwd:549872MyPassword )</FONT>
</P>
<P><FONT SIZE=2 FACE="Courier New">FR then splits the first 6 characters, and sends the authentication to the RADIUS listener that RSA bundles with Auth Mgr 6.1. </FONT></P>
<P><FONT SIZE=2 FACE="Courier New">FR ----> RSA-AuthMgr-RADIUS-listener</FONT>
<BR><FONT SIZE=2 FACE="Courier New">|</FONT>
<BR><FONT SIZE=2 FACE="Courier New">|-------> Campus Kerberos RADIUS server</FONT>
</P>
<P><FONT SIZE=2 FACE="Courier New">It then sends the campus Kerberos password (i.e. MyPassword) to the campus RADIUS server that front ends the Kerberos system.</FONT></P>
<P><FONT SIZE=2 FACE="Courier New">Since RADIUS is an async network protocol, Freeradius will have to set timers and wait for each to be successful before returning an accept to the NAS for the RADIUS request which it proxied. As Dan explained, this will probably be independent PAM calls to the two methods. </FONT></P>
<P><FONT SIZE=2 FACE="Courier New">Could be tricky.</FONT>
</P>
<P><FONT SIZE=2 FACE="Courier New">Dan @ UM.</FONT>
</P>
<P><FONT SIZE=2 FACE="Courier New">----</FONT>
</P>
<P><FONT SIZE=2 FACE="Courier New">Message: 2</FONT>
<BR><FONT SIZE=2 FACE="Courier New">Date: Tue, 23 Jan 2007 14:05:32 -0800 (PST)</FONT>
<BR><FONT SIZE=2 FACE="Courier New">From: Agent Smith <news8080@yahoo.com></FONT>
<BR><FONT SIZE=2 FACE="Courier New">Subject: Re: Splitting the password field in freeRADIUS</FONT>
<BR><FONT SIZE=2 FACE="Courier New">To: FreeRadius users mailing list</FONT>
<BR> <FONT SIZE=2 FACE="Courier New"><freeradius-users@lists.freeradius.org></FONT>
<BR><FONT SIZE=2 FACE="Courier New">Message-ID: <529131.95171.qm@web50915.mail.yahoo.com></FONT>
<BR><FONT SIZE=2 FACE="Courier New">Content-Type: text/plain; charset=iso-8859-1</FONT>
</P>
<BR>
<P><FONT SIZE=2 FACE="Courier New">I frontend our secureID server with FR. but that is</FONT>
<BR><FONT SIZE=2 FACE="Courier New">only doing PAP. The way I do this is radius proxy whre</FONT>
<BR><FONT SIZE=2 FACE="Courier New">the FR is running on the same box different port. </FONT>
</P>
<P><FONT SIZE=2 FACE="Courier New">I don't understand what you are trying to do here. If</FONT>
<BR><FONT SIZE=2 FACE="Courier New">a user tried to authenticate you want the PIN to</FONT>
<BR><FONT SIZE=2 FACE="Courier New">authenticate on radius? and the rest somewhere else?</FONT>
</P>
</BODY>
</HTML>