Hi Arjan

But we are setting up a new company and I was thinking if there is maybe a way to cut out the onprem/cloud based AD ? So AzureAD->freeradius without losing the capability to do TTLS- pap AND Peap-mschapv2 ? (no certificates)

Based on what I recently read in the PacketFence documentation - which integrates FreeRADIUS - you could only do EAP-TTLS PAP with plain Azure AD, but I lack actual experience to tell you how well it works. Based on shortly skimming through the PacketFence repository, they seem to have integrated freeradius-oauth2-perl, so you might be able to get that without a full-blown PacketFence setup. However if you want to do PEAP-MSCHAPv2 to, I'm guessing you'd still need an actual Active Directory Directory Services which Azure AD isn't. However you could add Azure Active Directory Domain Services (Azure AD DS). This way a Azure VM with FreeRADIUS could be used to join your Azure AD DS to have PEAP-MSCHAPv2. But again: I have no experience in actually using something like that. Also there are other limitations over a on-premises AD DS, such as not having the ability to extend the LDAP schema. It's more or less a AD DS as a service if I'm understanding it correctly. -- Mathieu

You can probably get away with Azure AD + AAD Directory Services (AADDS) here - not tested myself, as we shifted to certificate-based auth (AAD + SCEPman). --- Peter Bance Information Security Adviser On 2022-03-31 12:08, a.sinnige@sae.edu wrote:

Hi all,

A bit of an open question about Azure.

I currently have running :

AzureAD->on prem AD->samba/ldap-> freeradius

Running every type of hardwarePC/Mac/Phones/BYOD for Staff/Students/External Eduroam users. Doing user/password type logins for wifi/ethernet/computers etc.. (not certs)

Most users are doing PEAP->mschapv2 by default. All without requiring to provision devices with profiles/certs.

This works quite well and THX to all freeradius staff for this wonderful product :-)

But we are setting up a new company and I was thinking if there is maybe a way to cut out the onprem/cloud based AD ? So AzureAD->freeradius without losing the capability to do TTLS-pap AND Peap-mschapv2 ? (no certificates)

Any ideas ?

Arjan Sinnige

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html