On Jan 6, 2019, at 10:16 AM, Tom Mustaki <tom@mustaki.com> wrote:
i am a noob in the freeradius business and really need some basic guidance. i was following an article: https://wiki.freeradius.org/guide/2FA-Active-Directory-plus-Proxy
and it worked fine.
That's good.
now my goal is to support push notification on mobile devices. (the freeradius should proxy the request without waiting for OTP input from the authenticating user.) instead the freeradius should, after successful LDAP bind, send username + p for password, to the OTP radius. that will trigger a push notification on the mobile device.
could anyone point me in the right direction on where and what to change?
The server can't do proxying *and* local authentication at the same time. But with a bit of minor configuration, it should work. The simple solution is to *not* set Auth-Type = LDAP. You should be able to do something like: authorize { ... ldap.authenticate # run LDAP bind if (ok) { update control { Proxy-To-Realm := "realm" } } ... } Alan DeKok.