Hello. I have one other question concerning proxying, and once again excuse me if I don't use the good terminology. I use EAP-TTLS/PAP between a 802.1X supplicant and a radius server. I would like to proxy the authentication to an other radius server. So, is it possible to 'decapsulate' the authentication protocol from EAP on the first radius server, and only send user-name/user-password attributes to the central radius server ? (i guess that my question is stupid, but I don't know how to express it in the good way...) thanks -- Samuel Degrande LIFL - UMR8022 CNRS - INRIA Futurs - Bat M3 Phone: (33)3.28.77.85.30 USTL - Universite de Lille 1 Fax: (33)3.28.77.85.37 59655 VILLENEUVE D'ASCQ CEDEX - FRANCE [CA certs: http://igc.services.cnrs.fr/CNRS-Standard/recherche.html ]
Samuel Degrande <Samuel.Degrande@lifl.fr> wrote:
I use EAP-TTLS/PAP between a 802.1X supplicant and a radius server. I would like to proxy the authentication to an other radius server. So, is it possible to 'decapsulate' the authentication protocol from EAP on the first radius server, and only send user-name/user-password attributes to the central radius server ?
Yes. Put the following into your "users" file to proxy the inner session for user "bob". bob FreeRADIUS-Proxied-To == 127.0.0.1, Proxy-To-Realm := "realm"
(i guess that my question is stupid, but I don't know how to express it in the good way...)
You did fine. Alan DeKok.
Alan DeKok wrote:
Samuel Degrande <Samuel.Degrande@lifl.fr> wrote:
I use EAP-TTLS/PAP between a 802.1X supplicant and a radius server. I would like to proxy the authentication to an other radius server. So, is it possible to 'decapsulate' the authentication protocol from EAP on the first radius server, and only send user-name/user-password attributes to the central radius server ?
Yes. Put the following into your "users" file to proxy the inner session for user "bob".
bob FreeRADIUS-Proxied-To == 127.0.0.1, Proxy-To-Realm := "realm"
After an observation of the radius output in debug mode, I did find that FreeRADIUS-Proxied-To attribute (which is not documented, isn't it ?), but I was not sure if it was the good way to do it. Thanks for your reply (and thanks for freeradius :-) )
participants (3)
-
Alan DeKok -
Samuel Degrande -
Samuel.Degrande