<html>
<head>
<style>
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
FONT-SIZE: 10pt;
FONT-FAMILY:Tahoma
}
</style>
</head>
<body class='hmmessage'>
<br>> > authorize {<br>> > preprocess<br>> > suffix<br>> > eap<br>> > pap<br>> > papauth<br>> > }<br>> <br>> pap really should go at the end - i believe the default<br>> config mentions this...with maybe exclaimation marks or<br>> capital letters?<br>> <br>> alan<br><br>How is this supposed to help me in any way to configure FR to do PAP authentication?<br>Accordingly to documentation, PAP should be listed last in authorize section becouse need to check passwords added by previous modules and normalize them.<br><div style="text-align: left;">In my case none previus modules (preprocess, suffix, eap) gives any known good password (and this is intended since i don't want the RADIUS server to "know" the real user password) su pap just give back NOOP.<br>I can even comment out pap in authorize section since just respond noop in any case.<br><br>Here are the log from radiusd -X in any case<br><br>**************** radiusd -X with pap and not papauth ******************<br>rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this.<br> modcall[authorize]: module "pap" returns noop for request 9<br>modcall: leaving group authorize (returns ok) for request 9<br>auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user<br>auth: Failed to validate the user.<br>**************************************************************<br><br>Since eap is over (final step of ttls) and no modules are adding a "known good" password for the user, pap respond noop and there is no Auth-Type configured.<br><br>**************** radiusd -X with pap after papauth ******************<br>Exec-Program output: Auth-Type = PAP<br>Exec-Program-Wait: value-pairs: Auth-Type = PAP<br>Exec-Program: returned: 0<br> modcall[authorize]: module "papauth" returns ok for request 4<br>rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this.<br> modcall[authorize]: module "pap" returns noop for request 4<br>rad_check_password: Found Auth-Type PAP<br>auth: type "PAP"<br>************************************************************<br><br>The script set the Auth-Type and pap just answer noop.<br><br><br>
**************** radiusd -X with pap before papauth ******************<br>rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this.<br> modcall[authorize]: module "pap" returns noop for request 9<br>Exec-Program output: Auth-Type = PAP<br>Exec-Program-Wait: value-pairs: Auth-Type = PAP<br>Exec-Program: returned: 0<br> modcall[authorize]: module "papauth" returns ok for request 9<br>modcall: leaving group authorize (returns ok) for request 9<br> rad_check_password: Found Auth-Type PAP<br>auth: type "PAP"<br>**************************************************************<br><br>Pap still answer with noop and do not set the Auth-Type but the script do the job setting the Auth-Type and letting the second script check the credentials.<br><br>**************** radiusd -X without pap in authorize ******************<br>Exec-Program output: Auth-Type = PAP<br>Exec-Program-Wait: value-pairs: Auth-Type = PAP<br>Exec-Program: returned: 0<br> modcall[authorize]: module "papauth" returns ok for request 9<br>modcall: leaving group authorize (returns ok) for request 9<br> rad_check_password: Found Auth-Type PAP<br>auth: type "PAP"<br>************************************************************<br><br>My question is which is the best way to correctly accomplish pap authentication WITHOUT using authorization checks.<br><br>My solution was to "force" Auth-Type to PAP in case we have username and password in radius attributes.<br>Another way is, i think, using a users file with "DEFAULT Auth-Type = PAP" but i read in many place NOT TO DO THAT.<br>Another way could be to check if is present the Auth-Type and set it to PAP if os not set and list that script as last on authorize section.<br><br>Which is the best solution?<br><br>Btw, in config i see:<br>******************* radiusd.conf ************* <br># As of 1.1.4, you should list "pap" last in this section.<br># See "man rlm_pap" for more information.<br>*****************************************<br>So no exclamations and capitals, just a "should".<br>And i do read the man page to understand a little more about what i was going to do.<br><br>Thanks in advance<br><br>Bye<br><br>Maccari Dario<br></div><br /><hr />Discover the new Windows Vista <a href='http://search.msn.com/results.aspx?q=windows+vista&mkt=en-US&form=QBRE' target='_new'>Learn more!</a></body>
</html>