On Jun 26, 2009, at 10:00 AM, Arran Cudbard-Bell wrote:
- Some have said EAP and LDAP can't be combined because LDAP requires plain text passwords here and EAP doesn't play ball in that manner
What EAP method are you using... The different EAP methods have different requirements.
Well, again, I'm trying to work from a default Freeradius installation. The debug output, of course, is many repetitions of authorize/authenticate. I assume it's all about establishing the SSL session to my device in a lot of those, ending with: [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled After that, the last few cycles of authorize/authenticate head in the direction of many PEAP references, and, I suspect things finally going off the rails here: Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for ldaptest with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. It's another round or two of authorize/auth relating to PEAP and tunneling before: [peap] Session established. Decoding tunneled attributes. [peap] Received EAP-TLV response. [peap] Had sent TLV failure. User was rejected earlier in this session. [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. I'd be happy to revert back to a fresh Freeradius install and step through this all again in a systematic manner. I just remain uncertain on the overall viability of LDAP/EAP in this context due to so many contradictory references I've seen about where clear-text needs to exist or not exist in the relationship. Some things I've read seem to suggest LDAP / EAP can't co-exist here - period. Others seem to suggest it works with the right combination of elements, but nothing I've tried to replicate from those examples/discussions has worked thus far. Thanks! - Aaron -- halfpress: http://www.halfpress.com TWiP: http://twiplog.com Documenting Democracy: http://www.docdem.org Aaron's MAME Boxes - http://www.mameblog.com Twitter: halfpress