Credentials format in Windows suplicant
Hi everybody, I have take a look to this post: http://freeradius.1045715.n5.nabble.com/MSCHAP-Authentication-Issue-td278514... And I totally agree with the behaviours described in the table. I have been experiencing the same. If I type the credentials on prompt of Windows supplicant like MYDOMAIN.COM\user password The request is accepted: Fri Jun 10 15:58:51 2011 : Info: ++[eap] returns ok Fri Jun 10 15:58:51 2011 : Auth: Login OK: [IRTA_NT\\jroldan/<via Auth-Type = EAP>] (from client WLC_SSCC port 1 cli 00-26-B6-59-F1-EA) But if I type user@mydomain.com password I get the next info: Fri Jun 10 16:11:52 2011 : Debug: Exec-Program output: Logon failure (0xc000006d) Fri Jun 10 16:11:52 2011 : Debug: Exec-Program-Wait: plaintext: Logon failure (0xc000006d) Fri Jun 10 16:11:52 2011 : Debug: Exec-Program: returned: 1 Fri Jun 10 16:11:52 2011 : Info: [mschap] External script failed. Fri Jun 10 16:11:52 2011 : Info: [mschap] FAILED: MS-CHAP2-Response is incorrect Fri Jun 10 16:11:52 2011 : Info: ++[mschap] returns reject Fri Jun 10 16:11:52 2011 : Info: [eap] Freeing handler Fri Jun 10 16:11:52 2011 : Info: ++[eap] returns reject Fri Jun 10 16:11:52 2011 : Info: Failed to authenticate the user. Fri Jun 10 16:11:52 2011 : Auth: Login incorrect (mschap: External script says Logon failure (0xc000006d)): [jroldan@irta.es/<via Auth-Type = EAP>] (from client WLC_SSCC port 0 via TLS tunnel) I assume my configuration is fine (extracted from deployingradius.com) because its working by typing credentials in NT format. As the configuration of freeradius is for eduroam purpose it would be nice that user enter the credentials like user@domain.com, and in function of the domain the request would be proxied or not. Is is possible to use this format in spite of NT-domain? Thanks in advance. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Credentials-format-in-Windows-suplic... Sent from the FreeRadius - User mailing list archive at Nabble.com.
On 10/06/11 15:32, joanroldan wrote:
Hi everybody,
I have take a look to this post:
http://freeradius.1045715.n5.nabble.com/MSCHAP-Authentication-Issue-td278514...
The issue mentioned in that post was fixed in 2.1.10. Are you running 2.1.10?
And I totally agree with the behaviours described in the table.
Do you? That table does NOT contain: user@domain ...format credentials.
I have been experiencing the same. If I type the credentials on prompt of Windows supplicant like
MYDOMAIN.COM\user password
The request is accepted:
Fri Jun 10 15:58:51 2011 : Info: ++[eap] returns ok Fri Jun 10 15:58:51 2011 : Auth: Login OK: [IRTA_NT\\jroldan/<via Auth-Type = EAP>] (from client WLC_SSCC port 1 cli 00-26-B6-59-F1-EA)
But if I type
user@mydomain.com password
I get the next info:
This is not useful. Please show a full debug, from running "radiusd -X | tee log".
As the configuration of freeradius is for eduroam purpose it would be nice that user enter the credentials like user@domain.com, and in function of the domain the request would be proxied or not.
Is is possible to use this format in spite of NT-domain?
Yes, you just need to configure it appropriately. I suspect your problems is that your "ntlm_auth" line is expanding to: ntlm_auth --username=user@domain ... ...which won't work. %{mschap:User-Name} only handles DOMAIN\user host/name.domain.com plainuser ...it does NOT handle: user@domain ...but it maybe (probably?) should. Since a virtual server which is handling eduroam should *ALWAYS* see user@domain, you can write something like this in "inner-tunnel": authorize { if (User-Name =~ /^([^@]*)@(.+)$/) { update request { Stripped-User-Name := "%{1}" Realm := "%{toupper:%{2}}" } } else { reject } # FIXME: you should check the Realm here is one of yours # ...other modules } ...and then in modules/mschap, the "ntlm_auth" config: --username=%{Stripped-User-Name:-%{mschap:User-Name}} ...which will expand as follows: user@domain -> --username=user DOMAIN\user -> --username=user user -> --username=user
Hi Phil, Thank you for the reply. Yes I am running 2.1.10 I have made the changes you proposed and I see in the debug: Tue Jun 14 10:12:46 2011 : Info: ++- entering if (User-Name =~ /^([^@]*)@(.+)$/) {...} Tue Jun 14 10:12:46 2011 : Info: expand: %{1} -> jroldan Tue Jun 14 10:12:46 2011 : Info: expand: %{2} -> irta.es Tue Jun 14 10:12:46 2011 : Info: expand: %{toupper:%{2}} -> IRTA.ES How the expand is done. But I still can not authenticate with user@domain format. I attach you the radius output: http://freeradius.1045715.n5.nabble.com/file/n4487147/radius-Xx.txt radius-Xx.txt a good auth with nt format: http://freeradius.1045715.n5.nabble.com/file/n4487147/auth_ok_nt_format.txt auth_ok_nt_format.txt a bad auth with "email" format: http://freeradius.1045715.n5.nabble.com/file/n4487147/auth_no_ok_mail_format... auth_no_ok_mail_format.txt Thank you very much for your support. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Credentials-format-in-Windows-suplic... Sent from the FreeRadius - User mailing list archive at Nabble.com.
Hi everybody, I have successfully authenticated a user by adding this portion authorize { if (User-Name =~ /^([^@]*)@(.+)$/) { update request { Stripped-User-Name := "%{1}" Realm := "%{toupper:%{2}}" } } else { reject } that Phil provide me. The internal authentication/accounting with Active Directory is fine, so all corporate users using eduroam with internal realms in the credentials can gain access to the network. However, using users from another realms which have to be proxied do not. In debug mode the request is proxied: u Jun 23 15:22:03 2011 : Info: Ready to process requests. rad_recv: Access-Request packet from host 172.18.1.10 port 32769, id=97, length=203 User-Name = "proves_irta@cesca.cat" Calling-Station-Id = "00-26-B6-59-F1-EA" Called-Station-Id = "00-22-55-F1-80-B0:eduroam" NAS-Port = 1 NAS-IP-Address = 172.18.1.10 NAS-Identifier = "WLC_SSCC" Airespace-Wlan-Id = 1 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "50" EAP-Message = 0x0205001a0170726f7665735f697274614063657363612e636174 Message-Authenticator = 0x559f7e2dfefa8dffefb282cb2c7dae91 Thu Jun 23 15:22:16 2011 : Info: # Executing section authorize from file /etc/raddb/sites-enabled/default Thu Jun 23 15:22:16 2011 : Info: +- entering group authorize {...} Thu Jun 23 15:22:16 2011 : Info: ++[chap] returns noop Thu Jun 23 15:22:16 2011 : Info: ++[mschap] returns noop Thu Jun 23 15:22:16 2011 : Info: [suffix] Looking up realm "cesca.cat" for User-Name = "proves_irta@cesca.cat" Thu Jun 23 15:22:16 2011 : Info: [suffix] Found realm "DEFAULT" Thu Jun 23 15:22:16 2011 : Info: [suffix] Adding Realm = "DEFAULT" Thu Jun 23 15:22:16 2011 : Info: [suffix] Proxying request from user proves_irta to realm DEFAULT Thu Jun 23 15:22:16 2011 : Info: [suffix] Preparing to proxy authentication request to realm "DEFAULT" Thu Jun 23 15:22:16 2011 : Info: ++[suffix] returns updated Thu Jun 23 15:22:16 2011 : Info: [eap] Request is supposed to be proxied to Realm DEFAULT. Not doing EAP. Thu Jun 23 15:22:16 2011 : Info: ++[eap] returns noop Thu Jun 23 15:22:16 2011 : Info: ++[files] returns noop Thu Jun 23 15:22:16 2011 : Info: WARNING: Empty pre-proxy section. Using default return values. Sending Access-Request of id 113 to 84.88.0.19 port 1812 User-Name = "proves_irta@cesca.cat" Calling-Station-Id = "00-26-B6-59-F1-EA" Called-Station-Id = "00-22-55-F1-80-B0:eduroam" NAS-Port = 1 NAS-IP-Address = 172.18.1.10 NAS-Identifier = "WLC_SSCC" Airespace-Wlan-Id = 1 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "50" EAP-Message = 0x0205001a0170726f7665735f697274614063657363612e636174 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x3937 Thu Jun 23 15:22:16 2011 : Info: Proxying request 0 to home server 84.88.0.19 port 1812 Sending Access-Request of id 113 to 84.88.0.19 port 1812 User-Name = "proves_irta@cesca.cat" Calling-Station-Id = "00-26-B6-59-F1-EA" Called-Station-Id = "00-22-55-F1-80-B0:eduroam" NAS-Port = 1 NAS-IP-Address = 172.18.1.10 NAS-Identifier = "WLC_SSCC" Airespace-Wlan-Id = 1 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "50" EAP-Message = 0x0205001a0170726f7665735f697274614063657363612e636174 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x3937 Thu Jun 23 15:22:16 2011 : Debug: Going to the next request Thu Jun 23 15:22:16 2011 : Debug: Waking up in 0.9 seconds. Thu Jun 23 15:22:17 2011 : Debug: Waking up in 12.9 seconds. rad_recv: Access-Request packet from host 172.18.1.10 port 32769, id=97, length=203 Thu Jun 23 15:22:18 2011 : Info: Sending duplicate proxied request to home server 84.88.0.19 port 1812 - ID: 113 Sending Access-Request of id 113 to 84.88.0.19 port 1812 User-Name = "proves_irta@cesca.cat" Calling-Station-Id = "00-26-B6-59-F1-EA" Called-Station-Id = "00-22-55-F1-80-B0:eduroam" NAS-Port = 1 NAS-IP-Address = 172.18.1.10 NAS-Identifier = "WLC_SSCC" Airespace-Wlan-Id = 1 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "50" EAP-Message = 0x0205001a0170726f7665735f697274614063657363612e636174 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x3937 Thu Jun 23 15:22:18 2011 : Debug: Waking up in 11.9 seconds. rad_recv: Access-Request packet from host 172.18.1.10 port 32769, id=97, length=203 Thu Jun 23 15:22:20 2011 : Info: Sending duplicate proxied request to home server 84.88.0.19 port 1812 - ID: 113 Sending Access-Request of id 113 to 84.88.0.19 port 1812 User-Name = "proves_irta@cesca.cat" Calling-Station-Id = "00-26-B6-59-F1-EA" Called-Station-Id = "00-22-55-F1-80-B0:eduroam" NAS-Port = 1 NAS-IP-Address = 172.18.1.10 NAS-Identifier = "WLC_SSCC" Airespace-Wlan-Id = 1 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "50" EAP-Message = 0x0205001a0170726f7665735f697274614063657363612e636174 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x3937 Thu Jun 23 15:22:20 2011 : Debug: Waking up in 9.9 seconds. rad_recv: Access-Request packet from host 172.18.1.10 port 32769, id=97, length=203 Thu Jun 23 15:22:22 2011 : Info: Sending duplicate proxied request to home server 84.88.0.19 port 1812 - ID: 113 Sending Access-Request of id 113 to 84.88.0.19 port 1812 User-Name = "proves_irta@cesca.cat" Calling-Station-Id = "00-26-B6-59-F1-EA" Called-Station-Id = "00-22-55-F1-80-B0:eduroam" NAS-Port = 1 NAS-IP-Address = 172.18.1.10 NAS-Identifier = "WLC_SSCC" Airespace-Wlan-Id = 1 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "50" EAP-Message = 0x0205001a0170726f7665735f697274614063657363612e636174 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x3937 Thu Jun 23 15:22:22 2011 : Debug: Waking up in 7.9 seconds. rad_recv: Access-Request packet from host 172.18.1.10 port 32769, id=97, length=203 Thu Jun 23 15:22:24 2011 : Info: Sending duplicate proxied request to home server 84.88.0.19 port 1812 - ID: 113 Sending Access-Request of id 113 to 84.88.0.19 port 1812 User-Name = "proves_irta@cesca.cat" Calling-Station-Id = "00-26-B6-59-F1-EA" Called-Station-Id = "00-22-55-F1-80-B0:eduroam" NAS-Port = 1 NAS-IP-Address = 172.18.1.10 NAS-Identifier = "WLC_SSCC" Airespace-Wlan-Id = 1 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "50" EAP-Message = 0x0205001a0170726f7665735f697274614063657363612e636174 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x3937 Thu Jun 23 15:22:24 2011 : Debug: Waking up in 5.9 seconds. rad_recv: Access-Request packet from host 172.18.1.10 port 32769, id=97, length=203 Thu Jun 23 15:22:26 2011 : Info: Sending duplicate proxied request to home server 84.88.0.19 port 1812 - ID: 113 Sending Access-Request of id 113 to 84.88.0.19 port 1812 User-Name = "proves_irta@cesca.cat" Calling-Station-Id = "00-26-B6-59-F1-EA" Called-Station-Id = "00-22-55-F1-80-B0:eduroam" NAS-Port = 1 NAS-IP-Address = 172.18.1.10 NAS-Identifier = "WLC_SSCC" Airespace-Wlan-Id = 1 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "50" EAP-Message = 0x0205001a0170726f7665735f697274614063657363612e636174 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x3937 Thu Jun 23 15:22:26 2011 : Debug: Waking up in 3.9 seconds. Thu Jun 23 15:22:30 2011 : Info: WARNING: Internal sanity check failed in event handler for request 0: Discarding the request! Thu Jun 23 15:22:30 2011 : Info: Ready to process requests. to the radius server as proxy.conf has the realm DEFAULT to this RADIUS. I understand that it does not do EAP, but it must be done? The administrator of the proxy RADIUS says that he receive the request but after sending the challenge, my freeradius do not answer? Could anyone explain me this, please? -- View this message in context: http://freeradius.1045715.n5.nabble.com/Credentials-format-in-Windows-suplic... Sent from the FreeRadius - User mailing list archive at Nabble.com.
Hi,
However, using users from another realms which have to be proxied do not. In debug mode the request is proxied:
so, issue with remote proxy. you say that the admin of the remote proxy says that he can see your requests...but you dont answer he stuff that gets sent back? in this case, check your firewalls (and host firewall) to ensure that the required UDP ports are open from that remote proxy to you - this is UDP , after all, and not TCP! :-) alan
On 23/06/11 14:28, joanroldan wrote:
However, using users from another realms which have to be proxied do not. In debug mode the request is proxied:
I assume you're using eduroam?
Sending Access-Request of id 113 to 84.88.0.19 port 1812 User-Name = "proves_irta@cesca.cat" Calling-Station-Id = "00-26-B6-59-F1-EA" Called-Station-Id = "00-22-55-F1-80-B0:eduroam" NAS-Port = 1 NAS-IP-Address = 172.18.1.10 NAS-Identifier = "WLC_SSCC" Airespace-Wlan-Id = 1 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "50" EAP-Message = 0x0205001a0170726f7665735f697274614063657363612e636174 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x3937
Your eduroam national proxy is not replying. Check your shared secrets in proxy.conf, and if necessary liase with your national eduroam provider. You might also want to check firewalls etc.
participants (3)
-
Alan Buxey -
joanroldan -
Phil Mayers