Hello everyone,

I would like to receive some help on authentication with AD using CHAP Passwords. I´ve already configured the radius (v 2.1.6) to authenticate in the AD (Microsoft) using LDAP and clear-text passwords, until now it works perfectly, but in the radius debug appear the following message:

“rad_recv: Access-Request packet from host 192.168.0.100 port 64871, id=7, length=50

        User-Name = "1000700025"

        User-Password = "123456"

+- entering group authorize {...}

++[preprocess] returns ok

[suffix] No '@' in User-Name = "1000700025", looking up realm NULL

[suffix] No such realm "NULL"

++[suffix] returns noop

[ldap] performing user authorization for 1000700025

[ldap] WARNING: Deprecated conditional expansion ":-".  See "man unlang" for details

[ldap]  expand: (sAMAccountName=%{Stripped-User-Name:-%{User-Name}}) -> (sAMAccountName=1000700025)

[ldap]  expand: dc=pedagogico,dc=net -> dc=pedagogico,dc=net

rlm_ldap: ldap_get_conn: Checking Id: 0

rlm_ldap: ldap_get_conn: Got Id: 0

rlm_ldap: attempting LDAP reconnection

rlm_ldap: (re)connect to 172.17.16.4:389, authentication 0

rlm_ldap: bind as wni@pedagogico.net/wni@2009 to 172.17.16.4:389

rlm_ldap: waiting for bind result ...

rlm_ldap: Bind was successful

rlm_ldap: performing search in dc=pedagogico,dc=net, with filter (sAMAccountName=1000700025)

[ldap] looking for check items in directory...

[ldap] looking for reply items in directory...

è WARNING: No "known good" password was found in LDAP.  Are you sure that the user is configured correctly? ç

[ldap] Setting Auth-Type = LDAP

[ldap] user 1000700025 authorized to use remote access

rlm_ldap: ldap_release_conn: Release Id: 0

++[ldap] returns ok

++[expiration] returns noop

++[logintime] returns noop

Found Auth-Type = LDAP

+- entering group LDAP {...}

[ldap] login attempt by "1000700025" with password "123456"

[ldap] user DN: CN=LUIZ RICARDO DE VILLA SCANDELARI,OU=Users,OU=UNIFAE,OU=Users and Computers,DC=PEDAGOGICO,DC=NET

rlm_ldap: (re)connect to 172.17.16.4:389, authentication 1

rlm_ldap: bind as CN=LUIZ RICARDO DE VILLA SCANDELARI,OU=Users,OU=UNIFAE,OU=Users and Computers,DC=PEDAGOGICO,DC=NET/123456 to 172.17.16.4:389

rlm_ldap: waiting for bind result ...

rlm_ldap: Bind was successful

[ldap] user 1000700025 authenticated succesfully

++[ldap] returns ok

+- entering group post-auth {...}

++[exec] returns noop

Sending Access-Accept of id 7 to 192.168.0.100 port 64871

Finished request 0.”

I suppose that happens because I cannot read the AD user password, right? The important is that works with LDAP authentication. The problem is that I have a system that sends Access-Requests with Username and CHAP-Passwords (CoovaChilli), so radius authorize the user but cannot authenticate it.

I´ve already read the Allan´s webpage (http://deployingradius.com/documents/configuration/active_directory.html) about integration of AD and RADIUS but I still have some questions. Can I use CHAP with SAMBA ntlm_auth method or should i need to change the password encryption to another protocol such as PAP or MS-CHAP? If I modify the coovachilli to send PAP passwords, am I  going to be able to use ldap for authorization and authentication or do I need just plain?

I hope somebody can help me.

Thanks,

LUIZ GUSTAVO SCANDELARI

Skype: luiz.gustavo.wni