<HTML><HEAD>
<META content="text/html; charset=iso-8859-15" http-equiv=Content-Type>
<META name=GENERATOR content="MSHTML 8.00.7600.16671"></HEAD>
<BODY style="MARGIN: 4px 4px 1px; FONT: 10pt Segoe UI">
<DIV>Hi Alan,</DIV>
<DIV> </DIV>
<DIV> Thanks for info. Next question is "what??" HeHe. I started looking at the files you suggested and I am confused. </DIV>
<DIV> </DIV>
<DIV> First you mention looking into the realm information, did that, it is looking like that may not be to hard to do, if I am using the FR server to access the LDAP server then I just need to set a realm of ntdomain and auth=LOCAL, correct? Then you go on to say strip the domain at the LDAP lookup, well if I do it there wouldn't that fix the problem regardless of changing the realm? You go on to explain that I should do the LDAP lookup in the inner-tunnel config, I have no problem with this, it makes sense, the problem I have is how do you specify the inner tunnel in the configuration?</DIV>
<DIV> </DIV>
<DIV> Remember, I am new to FreeRadius, been using Cisco ACS for a few years now so I know about Radius in general, just not how to configure FreeRadius and docs are a bit hard to come by. If you can specify the files I should look at to configure the inner tunnel authentication and where to specify stripping the domain name pre-ldap authentication that would help a lot. I was not sure if I should attempt stripping the domain in the realm portion or right before the ldap auth.</DIV>
<DIV> </DIV>
<DIV>Thanks again, I will continue and try to figure out where to do this until I hear back.</DIV>
<DIV> </DIV>
<DIV>
<DIV>Brett Littrell</DIV>
<DIV>Network Manager</DIV>
<DIV>MUSD</DIV>
<DIV>CISSP, CCSP, CCVP, MCNE</DIV><BR><BR>>>> On Friday, January 21, 2011 at 11:56 PM, in message <4D3A8DA0.7050702@deployingradius.com>, Alan DeKok <aland@deployingradius.com> wrote:<BR></DIV>
<TABLE style="MARGIN: 0px 0px 0px 15px; FONT-SIZE: 1em" border=0 bgColor=#f3f3f3>
<TBODY>
<TR>
<TD>
<DIV style="BORDER-LEFT: #050505 1px solid; PADDING-LEFT: 7px">Brett Littrell wrote:<BR>> I am trying to strip the domain name from a userid in the most<BR>> efficient way possible, I am using version 2.1.1.<BR><BR> See the "realms" module, and the "realm" definition in raddb/proxy.conf.<BR><BR>> I am using MSChapV2 <BR><BR> Then stripping the realm isn't a good idea. The User-Name is used as<BR>part of the MS-CHAPv2 calculations, so changing it will make the<BR>authentication fail.<BR><BR>> I then found another reference to strip the domain from the LDAP<BR>> module as shown below:<BR>> filter = "(cn=%{mschap:User-Name:-%{User-Name}}<BR><BR> This is wrong. You're not closing the opening bracket:<BR><BR>filter = "(cn=%{mschap:User-Name:-%{User-Name}})"<BR><BR>> and it seems to pass the correct username to<BR>> the LDAP server it looks like there is some other place I need to strip<BR>> the domain besides the ldap lookup, that or the replies are using the<BR>> stripped name and it is failing that way as well. Either way it still<BR>> is not working. If I un-comment the stripped-user-name and use a<BR>> supplicant that strips the domain prior to sending it, it does work so<BR>> Radius is working, just now with standard windows supplicant on XP.<BR><BR> If you're using EAP, you *really* don't want to strip the User-Name.<BR>It will make EAP fail.<BR><BR>> An yes I am pretty new to freeradius.<BR><BR> What you want is to change the *ldap* lookup so that it uses only the<BR>name portion of the User-Name. *Don't* edit the User-Name.<BR><BR> And move the LDAP lookup to the "inner-tunnel" configuration. That's<BR>what it's for. Don't do LDAP lookups in raddb/sites-available/default<BR><BR> Alan DeKok.<BR>-<BR>List info/subscribe/unsubscribe? See <A href="http://www.freeradius.org/list/users.html">http://www.freeradius.org/list/users.html</A><BR></DIV></TD></TR></TBODY></TABLE></BODY></HTML>