Radius proxy request to other radius for OTP auth
Let me explain what we are trying to do, we have Cisco anyconnect VPN and we are using onelogin RADIUS (https://www.onelogin.com/) for OTP, we have our own OpenLDAP server and onelogin sync our directory service and provide Auth with OTP solution. Recently we decided to create multiple Group Policy for VPN and every group will have own permission to access application, like Sales, Finance and contractor etc, In short contractor can't access Finance related application etc. After reading found ASA support RADIUS attribute Class 25 where i can create OU=sales and implement policy base on whatever LDAP memberOf list users. But unfortunately onelogin doesn't support that kind of attributes mapping and now we stuck here so only solution is to deploy on radius server and integrate with google authenticator. So i have question is there anyway i can use FreeRadius locally and use attributes Class 25 and then proxy authentication to onlelogin RADIUS? What should i do and what you guys suggest here?
On Oct 26, 2017, at 10:58 PM, Satish Patel <satish.txt@gmail.com> wrote:
Recently we decided to create multiple Group Policy for VPN and every group will have own permission to access application, like Sales, Finance and contractor etc, In short contractor can't access Finance related application etc.
I'm not sure that's possible in RADIUS. You can send policies to the VPN (maybe), but the VPN may ignore them.
After reading found ASA support RADIUS attribute Class 25 where i can create OU=sales and implement policy base on whatever LDAP memberOf list users.
That's vague... what, exactly are you doing? What piece of the network is doing what?
But unfortunately onelogin doesn't support that kind of attributes mapping and now we stuck here so only solution is to deploy on radius server and integrate with google authenticator.
How does deploying a RADIUS server help with controlling access to applications?
So i have question is there anyway i can use FreeRadius locally and use attributes Class 25 and then proxy authentication to onlelogin RADIUS?
FreeRADIUS can use Class. So? What does it *do* with it?
What should i do and what you guys suggest here?
First, you have to describe what you're doing. Which network machines are involved? What are they doing? What information do they exchange? Alan DeKok.
In short this is what i am planning to do with FreeRadius instead of IAS windows http://www.dasblinkenlichten.com/using-radius-attributes-during-webvpn-logon... We have Multi Factor authentication (password+OTP) for VPN login, and MFA (multi factor auth) provided by onelogin company, in my Cisco ASA i tell my RADIUS server is onlogin in cloud and my asa authenticate users from there, but that company doesn't support Attribute Class 25 which i posted in link, so i was thinking to build Freeradius in-house and do whatever i want there for grouping and then proxy request to onlogin for OTP stuff. In short my local radius will act like Proxy and forward request to onelogin in cloud for OTP. I am not sure it's possible or not so just trying to see what people think about it or any other way out. On Fri, Oct 27, 2017 at 8:43 AM, Alan DeKok <aland@deployingradius.com> wrote:
On Oct 26, 2017, at 10:58 PM, Satish Patel <satish.txt@gmail.com> wrote:
Recently we decided to create multiple Group Policy for VPN and every group will have own permission to access application, like Sales, Finance and contractor etc, In short contractor can't access Finance related application etc.
I'm not sure that's possible in RADIUS. You can send policies to the VPN (maybe), but the VPN may ignore them.
After reading found ASA support RADIUS attribute Class 25 where i can create OU=sales and implement policy base on whatever LDAP memberOf list users.
That's vague... what, exactly are you doing? What piece of the network is doing what?
But unfortunately onelogin doesn't support that kind of attributes mapping and now we stuck here so only solution is to deploy on radius server and integrate with google authenticator.
How does deploying a RADIUS server help with controlling access to applications?
So i have question is there anyway i can use FreeRadius locally and use attributes Class 25 and then proxy authentication to onlelogin RADIUS?
FreeRADIUS can use Class. So? What does it *do* with it?
What should i do and what you guys suggest here?
First, you have to describe what you're doing. Which network machines are involved? What are they doing? What information do they exchange?
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Oct 27, 2017, at 12:05 PM, Satish Patel <satish.txt@gmail.com> wrote:
In short this is what i am planning to do with FreeRadius instead of IAS windows http://www.dasblinkenlichten.com/using-radius-attributes-during-webvpn-logon...
You just configure FreeRADIUS to send the Class attribute back. That should be simple.
We have Multi Factor authentication (password+OTP) for VPN login, and MFA (multi factor auth) provided by onelogin company, in my Cisco ASA i tell my RADIUS server is onlogin in cloud and my asa authenticate users from there, but that company doesn't support Attribute Class 25 which i posted in link,
Then you can't do it.
so i was thinking to build Freeradius in-house and do whatever i want there for grouping and then proxy request to onlogin for OTP stuff. In short my local radius will act like Proxy and forward request to onelogin in cloud for OTP.
That still isn't clear. If the VPN doesn't support Class, then adding FreeRADIUS won't help. Alan DeKok.
That still isn't clear. If the VPN doesn't support Class, then adding FreeRADIUS won't help.
VPN does support that Class On Fri, Oct 27, 2017 at 12:10 PM, Alan DeKok <aland@deployingradius.com> wrote:
On Oct 27, 2017, at 12:05 PM, Satish Patel <satish.txt@gmail.com> wrote:
In short this is what i am planning to do with FreeRadius instead of IAS windows http://www.dasblinkenlichten.com/using-radius-attributes-during-webvpn-logon...
You just configure FreeRADIUS to send the Class attribute back. That should be simple.
We have Multi Factor authentication (password+OTP) for VPN login, and MFA (multi factor auth) provided by onelogin company, in my Cisco ASA i tell my RADIUS server is onlogin in cloud and my asa authenticate users from there, but that company doesn't support Attribute Class 25 which i posted in link,
Then you can't do it.
so i was thinking to build Freeradius in-house and do whatever i want there for grouping and then proxy request to onlogin for OTP stuff. In short my local radius will act like Proxy and forward request to onelogin in cloud for OTP.
That still isn't clear. If the VPN doesn't support Class, then adding FreeRADIUS won't help.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (2)
-
Alan DeKok -
Satish Patel