<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><br>On 1 Oct 2014, at 10:19, Arran Cudbard-Bell <<a href="mailto:a.cudbardb@freeradius.org">a.cudbardb@freeradius.org</a>> wrote:<br><br><blockquote type="cite">The issue here is probably that you need to call yubikey.authorize to do the otp/password split, then call yubikey.</blockquote><div><br></div><div>yubikey.authorize needs to be called after EAP-GTC has added the User-Password attribute, so it can split the</div><div>string into Yubikey-OTP and User-Password.</div><div><br></div><div>yubikey(.authenticate) will take care of validating Yubikey-OTP with the AES key, and PAP can be used to check</div><div>the password.</div><div><br></div><div>Usually User-Password is available in authorize {} which is why the logic to do the splitting is there. IIRC </div><div>yubikey.authorize also splits out Yubikey-Public-ID, which you should really be using to lookup the AES key and</div><div>not User-Name (else the user can only ever have one key).</div><div><br></div><div>If the EAP sub-module is extracting the User-Password in authorize, you probably want something like:</div><div><br></div><div>authorize {</div><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"><div>eap</div><div>if (ok || updated) {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>yubikey</div><div><span class="Apple-tab-span" style="white-space:pre"> </span><sql/ldap/files> (set control:Yubikey-Key and control:Cleartext-Password)</div><div>}</div></blockquote>}<div><br></div><div>authenticate {</div><div><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"><div>yubikey {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>yubikey</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>pap</div><div>}</div></blockquote></div><div>}</div><div><br></div><div>-Arran<br><div><br></div><div><div><div>Arran Cudbard-Bell <<a href="mailto:a.cudbardb@freeradius.org">a.cudbardb@freeradius.org</a>><br>FreeRADIUS development team<br><br>FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2<br></div><br></div></div></div></body></html>