Hi Alan, Thanks a lot, it worked with suffix testuser@hcrpp.com and without suffix testuser for the domain hcrpp.com, but when i authenticate with of external domain cr.net i get this error message: (17) eap: Expiring EAP session with state 0x94f1143794f70ec2 (17) eap: Finished EAP session with state 0x94f1143794f70ec2 (17) eap: Previous EAP request found for state 0x94f1143794f70ec2, released from the list (17) eap: Peer sent packet with method EAP MSCHAPv2 (26) (17) eap: Calling submodule eap_mschapv2 to process data (17) eap_mschapv2: # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (17) eap_mschapv2: Auth-Type MS-CHAP { (17) mschap: WARNING: No Cleartext-Password configured. Cannot create NT-Password (17) mschap: WARNING: No Cleartext-Password configured. Cannot create LM-Password (17) mschap: Creating challenge hash with username: testuser@cr.net (17) mschap: Client is using MS-CHAPv2 (17) mschap: ERROR: FAILED: No NT/LM-Password. Cannot perform authentication (17) mschap: ERROR: MS-CHAP2-Response is incorrect Can i send cleartext-password for only the specific domain cr.net ? Thanks a lot, Alan! On Thu, Jun 28, 2018 at 3:29 PM Alan DeKok <aland@deployingradius.com> wrote:
On Jun 28, 2018, at 2:02 PM, Andrei Antonelli <andreirp@gmail.com> wrote:
Hi, could someone help me with the example of my configuration below?
Please only post one message instead of two.
When i'm logging with username and password *without suffix*, *it's works*, but when i'm logging with *suffix *like testuser@hcrpp.com or testuser@ cr.net i get this error message:
suffix: Checking for suffix after "@" (22) suffix: Looking up realm "hcrpp.com" for User-Name = "testuser@ hcrpp.com" (22) suffix: Found realm "hcrpp.com" (22) suffix: Adding Realm = "hcrpp.com"
That's fine.
(22) suffix: Proxying request from user testuser@hcrpp.com to realm hcrpp.com (22) suffix: Preparing to proxy authentication request to realm " hcrpp.com" (22) [suffix] = updated (22) update control { (22) &Proxy-To-Realm := "LOCAL" (22) } # update control = noop
Why are you doing this? It's unnecessary. You can just set the " hcrpp.com" realm to be a local realm. In proxy.conf, do:
realm hcrpp.com { }
That's it. See the comments in proxy.conf for more documentation.
(22) eap: Peer sent EAP Response (code 2) ID 6 length 81 (22) eap: No EAP Start, assuming it's an on-going EAP conversation (22) [eap] = updated (22) sql: EXPAND %{User-Name} (22) sql: --> testuser@hcrpp.com (22) sql: SQL-User-Name set to 'testuser@hcrpp.com'
See the comments in raddb/mods-config/main/mysql/queries.conf
You should edit the "sql_user_name" to be:
sql_user_name = %{%{Stripped-User-Name}:-%{User-Name}}
Which will then use "testuser" instead of "testuser@hcrpp.com"
*My config below*
We don't need the configuration. See http://wiki.freeradius.org/list-help
realm hcrpp.com { auth_pool = HCRPPOOL strip }
Which causes packets containing "username@hcrpp.com" to be proxied. If you don't want them to be proxied, read the comments in proxy.conf. This is explained in detail.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html