<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'><span style="color: rgb(68, 68, 68); font-size: 15px; line-height: 21.2999992370605px; background-color: rgb(255, 255, 255);">Hello,</span><div style="line-height: 21.2999992370605px; color: rgb(68, 68, 68); font-size: 15px; background-color: rgb(255, 255, 255);"><br style="line-height: 21.2999992370605px;"></div><div style="line-height: 21.2999992370605px; color: rgb(68, 68, 68); font-size: 15px; background-color: rgb(255, 255, 255);">I currently have a freeradius setup where the client authenticates using username/password. My goal is to authenticate the user using a client certificate (using EAP-TLS), however, I would still like to maintain the username/password authentication. Preferably the flow would be something like this:</div><div style="line-height: 21.2999992370605px; color: rgb(68, 68, 68); font-size: 15px; background-color: rgb(255, 255, 255);"><br style="line-height: 21.2999992370605px;"></div><div style="line-height: 21.2999992370605px; color: rgb(68, 68, 68); font-size: 15px; background-color: rgb(255, 255, 255);">1.User authenticates to radius_server_1 using EAP_TLS</div><div style="line-height: 21.2999992370605px; color: rgb(68, 68, 68); font-size: 15px; background-color: rgb(255, 255, 255);">2.radius_server_1 after authenticating the client (and only if authentication is sucessful) forwards a request to radius_server_2 with the client username/password</div><div style="line-height: 21.2999992370605px; color: rgb(68, 68, 68); font-size: 15px; background-color: rgb(255, 255, 255);">3.radius_server_2 authenticates client</div><div style="line-height: 21.2999992370605px; color: rgb(68, 68, 68); font-size: 15px; background-color: rgb(255, 255, 255);"><br style="line-height: 21.2999992370605px;"></div><div style="line-height: 21.2999992370605px; color: rgb(68, 68, 68); font-size: 15px; background-color: rgb(255, 255, 255);">So only if both radius_server_1 and radius_server_2 authenticate the client is the client granted access.</div><div style="line-height: 21.2999992370605px; color: rgb(68, 68, 68); font-size: 15px; background-color: rgb(255, 255, 255);"><br style="line-height: 21.2999992370605px;"></div><div style="line-height: 21.2999992370605px; color: rgb(68, 68, 68); font-size: 15px; background-color: rgb(255, 255, 255);">The flow doesn't necessarily need to be like the one above, I am open to suggestions, I'm not really sure what is possible and what isn't and would like to know my options.</div> </div></body>
</html>