Hi Alan, thank you very much for the fast answer! :) I thought it‘s not possible to put the otp in the password-attribute, as it comes as an mschap challenge, and not in cleartext - so the server cant match the password anymore?! Is it possible to modify the eap identity before its getting to the eap module? I got a similar setup working with AD, but I call the ntlm_auth with a stripped-username there, thats why it is working there. Thanks! Best regards
Am 09.11.2018 um 23:25 schrieb Alan DeKok <aland@deployingradius.com>:
On Nov 9, 2018, at 5:01 PM, Markus Maurer <lists@v-net.tk> wrote:
Hi everybody,
I'd like to build an IPSec IKEV2 VPN with 2-factor authentication over EAP-Radius and MSCHAPv2. The OTP should be placed in the "User-Name" attribute with a ":" as seperator. e.g.: <username>:<otp> - johndoe:123456
That's not recommended. It's much easier to put the OTP into the password.
In the authorize section the User-Name attribute get splitted in two parts: "Stripped-Username" and "User-OTP" if ( &User-Name =~ /^(.*):([0-9]{6})$/) { update request { Stripped-User-Name := "%{1}" User-OTP := "%{2}" } }
The first step is to authenticate the username with otp over rlm_perl. If the first step succeeds, the eap module will be called and makes an mschapv2 authentication over sql (cleartext password). And here is my problem. Whenever I get to this step, I get the following error: "rlm_eap: Identity does not match User-Name, setting from EAP identity"
When EAP happens, the server gets the users name as both the User-Name and as an EAP-Identitity. The two need to match.
The eap module uses the original username (johndoe:123456) and password for the mschap challenge.
That should work, I think.
Is there any way to use the "Stripped-Username" for mschap without executing ntlm_auth? I dont need to authenticate against AD.
No. MS-CHAP uses the *whole* User-Name for authentication. That's how MS-CHAP works.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -- This email was Malware checked by UTM 9. http://www.sophos.com