Thank you. FWIW, quoting the page was more me was trying to figure it out; it wasn't intended to offend. Your comments made me realize that freeradius is (to all intents and purposes) working properly, and that the problem lies with the ldap host. I'll need to figure that last bit out (your a and b above). It should be interesting with FreeIPA, which is notable for not making access to the NTHash passwords simple. thanks /mh On Mon, Mar 20, 2023 at 11:59 AM Alan DeKok <aland@deployingradius.com> wrote:
On Mar 20, 2023, at 12:44 PM, Matt H <meh1963@gmail.com> wrote:
Hello Alan - I think I described it badly. Our configuration does not use Active Directory. The order is this: supplicant (Mac or Windows) >> FreeRadius (via EAP
and
PEAP or EAP and MSCHAP) >> FreeIPA ldap server (389DS)
The LDAP server is not returning the clear-text password to FreeRADIUS.
I read the matrix at Deploying RADIUS: Protocol and Password Compatibility <http://deployingradius.com/documents/protocols/compatibility.html>, (lines 4, 5, and 6 first two columns) as supporting such a configuration.
Does your LDAP server store passwords clear-text, or NT hash, *and* return those values to FreeRADIUS?
a) no - FreeRADIUS never sees the passwords from LDAP, so it doesn't matter what the web page says
b) yes - the debug log shows that the LDAP server isn't returning the password to FreeRADIUS. See the previous line...
You can't just look at the web page and go "it's possible". I know it's possible. It also doesn't help to quote the web page to me. I do understand the page, because I wrote it.
What you need to understand is that the web page is irrelevant. Because....
The debug output shows that the LDAP server isn't returning a password to FreeRADIUS. Therefore, MS-CHAP won't work. So.... configure the LDAP server to return a clear-text password to FreeRADIUS. Or make it return an NT hash to FreeRADIUS.
It will then work.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Death before dishonour, Nothing before coffee