One virtual server for MS-chapv2 against AD w/ ntlm_auth, the other one against ldap ntpasswd hash possible?
We got ntlm_auth against AD working for PEAP, we also got separate server for PEAP against ldap ntPassword hash. in latest etc/raddb/modules/mschap # The module can perform authentication itself, OR # use a Windows Domain Controller. This configuration # directive tells the module to call the ntlm_auth # program, which will do the authentication, and return # the NT-Key. Note that you MUST have "winbindd" and # "nmbd" running on the local machine for ntlm_auth # to work. See the ntlm_auth program documentation # for details. # # If ntlm_auth is configured below, then the mschap # module will call ntlm_auth for every MS-CHAP # authentication request. If there is a cleartext # or NT hashed password available, you can set # "MS-CHAP-Use-NTLM-Auth := No" in the control items, # and the mschap module will do the authentication itself, # without calling ntlm_auth. # # Be VERY careful when editing the following line! Is there any way to have a virtual server(1812/1813) for mschapv2-ntlm_auth-AD and another virtual server(1814/1815) for mschapv2-ldap ntPassword hash? Here is our situation: We have faculty/staff in active directory.So we are using ntlm_auth against AD for their network authentication. Faculty/staff will sign on with username, it will get directed to ntpm_auth against AD. We have student in ldap with ntPassword but not in AD. So we would like to have student sign on with username@foo.edu, so we can manipulate the radius configuration to direct username@foo.edu to use ldap ntPassword authentication. Is there anyway using freeradius to accomplish this? Thanks for any insight! Schilling
schilling wrote:
We got ntlm_auth against AD working for PEAP, we also got separate server for PEAP against ldap ntPassword hash.
... Is there any way to have a virtual server(1812/1813) for mschapv2-ntlm_auth-AD and another virtual server(1814/1815) for mschapv2-ldap ntPassword hash?
Yes. But I don't think that's necessary.
Here is our situation: We have faculty/staff in active directory.So we are using ntlm_auth against AD for their network authentication. Faculty/staff will sign on with username, it will get directed to ntpm_auth against AD. We have student in ldap with ntPassword but not in AD. So we would like to have student sign on with username@foo.edu, so we can manipulate the radius configuration to direct username@foo.edu to use ldap ntPassword authentication.
Is there anyway using freeradius to accomplish this?
Yes. And you don't need two virtual servers. 1) edit the "authorize" section to do... 2) if people log in with "user@foo.edu", run "ldap" 3) else force "ntlm_auth" You might have to declare a "foo.edu" realm, but that shouldn't be an issue. The config should really be about 10 lines changed from the default. Develop this by: 1) adding realm "foo.edu" 2) enabling ldap 3) checking authentication 4) adding "if not realm foo.edu" 5) do ntlm_auth, as per the docs, wiki, etc. Alan DeKok.
Hi Alan, Thanks for the hint. Just to be sure. Both user(username and username@foo.edu) will use eap, mschapv2 to authenticate. But there is only one mschap module in etc/raddb/modules/? Regards, Schilling On Tue, Dec 7, 2010 at 3:41 PM, Alan DeKok <aland@deployingradius.com> wrote:
schilling wrote:
We got ntlm_auth against AD working for PEAP, we also got separate server for PEAP against ldap ntPassword hash.
... Is there any way to have a virtual server(1812/1813) for mschapv2-ntlm_auth-AD and another virtual server(1814/1815) for mschapv2-ldap ntPassword hash?
Yes. But I don't think that's necessary.
Here is our situation: We have faculty/staff in active directory.So we are using ntlm_auth against AD for their network authentication. Faculty/staff will sign on with username, it will get directed to ntpm_auth against AD. We have student in ldap with ntPassword but not in AD. So we would like to have student sign on with username@foo.edu, so we can manipulate the radius configuration to direct username@foo.edu to use ldap ntPassword authentication.
Is there anyway using freeradius to accomplish this?
Yes. And you don't need two virtual servers.
1) edit the "authorize" section to do... 2) if people log in with "user@foo.edu", run "ldap" 3) else force "ntlm_auth"
You might have to declare a "foo.edu" realm, but that shouldn't be an issue. The config should really be about 10 lines changed from the default.
Develop this by:
1) adding realm "foo.edu" 2) enabling ldap 3) checking authentication
4) adding "if not realm foo.edu" 5) do ntlm_auth, as per the docs, wiki, etc.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
schilling wrote:
Just to be sure. Both user(username and username@foo.edu) will use eap, mschapv2 to authenticate. But there is only one mschap module in etc/raddb/modules/?
So... configure another mschap module. See raddb/modules/files for examples of configuring two instances of the same module. Alan DeKok.
Got the whole setup working. So basically if users sign on with username@foo.edu with eap, they will be sent to ldap w/ ntpassword authorization. If users sign on with username only with eap, they will be sent to active directory w/ ntlm authentication. configuration changes are the following: etc/raddb/proxy.conf add realm foo.edu { } realm NULL { } /etc/raddb/site-enabled/inner-tunnel at the ldap line in authorize section add switch "%{Realm}" { case foo.edu { ldap #see /etc/raddb/module/mschap if ntpassword available, then do not use #NTLM_auth update control { MS-CHAP-Use-NTLM-Auth := NO } case NULL { mschap } } etc/raddb/module/mschap, etc/raddb/module/ntlm are all from integrate with Active Directory howto. Thanks for the great software, and can not wait to see the finish of the book. There are so many internals to be understood. Schilling On Wed, Dec 8, 2010 at 2:12 AM, Alan DeKok <aland@deployingradius.com> wrote:
schilling wrote:
Just to be sure. Both user(username and username@foo.edu) will use eap, mschapv2 to authenticate. But there is only one mschap module in etc/raddb/modules/?
So... configure another mschap module.
See raddb/modules/files for examples of configuring two instances of the same module.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (2)
-
Alan DeKok -
schilling