2011/11/10 Phil Mayers <p.mayers@imperial.ac.uk>
On 10/11/11 08:15, Alejandro Gandara wrote:
Hi Alan,
Thanks for your answers and excuse me for my english fill of mistakes.
2011/11/10 Alan DeKok <aland@deployingradius.com <mailto:aland@deployingradius.**com <aland@deployingradius.com>>>
Alejandro Gandara wrote: > I'm authenticating users in RADIUS against LDAP, if I login from > computer with 802.1x configured and users and password taken from domain > automatic. Im getting wrong authenticated because the login has the > following chain. > > DOMAIN\\Users > > How can i avoid that radius read the prefix?
You should be able to authenticate using just the user name, using ntlm_auth. See the examples in raddb/modules/ntlm_auth
Im reading about it. Thanks for this information.
> I've tried to introduce the option prefix in /etc/sites-enable/default , > but its getting me back errors because of wrong way to introduce that line.
Yes. Don't define a realm. It won't work.
Post the debug output. That helps, too.
This is my debug output:
rad_recv: Access-Request packet from host 172.20.40.28 port 1025, id=112, length=218 Framed-MTU = 1480 NAS-IP-Address = 172.20.40.28 NAS-Identifier = "SW-INT-1-3" User-Name = "PRIVATE\\usertest"
Have you edited this debug?
Service-Type = Framed-User
Framed-Protocol = PPP NAS-Port = 32 NAS-Port-Type = Ethernet NAS-Port-Id = "32" Called-Station-Id = "f0-62-81-05-33-40" Calling-Station-Id = "f0-4d-a2-bc-77-cd" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1" EAP-Message = 0x020a0012014f50544152455c6272**6f75636f
This decodes as:
\x02\n\x00\x12\x01OPTARE\\**brouco
Message-Authenticator = 0x055981a2c542df52f4c292042c89**a019
Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/**default +- entering group authenticate {...} *[eap] Identity does not match User-Name, setting from EAP Identity.*
This claims MSCHAP and Radius username don't match.
Did you edit the debug?
Don't do that.
Ok sorry
Please provide a full debug, like so:
radiusd -X | tee log.txt # run a test auth # ctrl+c # email log.txt
I've attached it
- List info/subscribe/unsubscribe? See http://www.freeradius.org/** list/users.html <http://www.freeradius.org/list/users.html>