I finally succeed in doing what i wanted to do. I had to implement to ldap instance one for the default server, other one for the inner-tunnel server. For the default server, i had to filter on NET-NodeID (filter in user section in ldap module configuration) and to reject authentication if nothing is found (add notfound=reject in call of ldap module in authorize section of default server configuration file) For the inner-tunnel server i keep the ldap module configuration and the inner tunnel unchanged. Thanks for your support. Tim Le 29/08/2016 à 19:44, Tim Baledorion a écrit :
Le 29/08/2016 à 17:49, Alan DeKok a écrit :
On Aug 29, 2016, at 9:21 AM, Tim Baledorion <timbaledorion@hotmail.com> wrote:
What is a "node identifier" ?
A node Identifier is a Item that identified the Node in my design it is Net-NodeID.
If you don't care enough to properly describe the issue, why should I care enough to help you?
In the inner-tunnel the authentication is done against LDAP database through radius ldap module. I wanted to check the NET-NodeID during the TLS phase that's why i was thinking it has to be there. Read the debug log. It shows you where the attribute is located.
A proxy *cannot* modify the data inside of a TLS tunnel. TLS is designed to prevent this... I understand that quite well. That's why i was asking if the i had to change something in the supplicant to allow the behaviour i was requesting. You can't change the supplicant.
Maybe i should modify the ldap module parameters to look through the LDAP database in the authorize section with a match for Net-NodeID first, and then authenticate as it is requested in PEAP-MSCHAPv2? If you think this id is the right one i would have probably to setup 2 ldap instance one for the inner-tunnel the other for the authorize section. The files raddb/sites-available/default and raddb/sites-available/inner-tunnel contain a lot of documentation and suggestions. Read them. I read theim again and find nothing about that except something related to operator-name that looks the same to what i would like to do....but i don't know if operator-name item can be a check item?
Thank you for your interest anyway.
Tim
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html