Hi, I'm moving step by step to get my system working... My architecture is: WEB.CLIENT<--->CHILLI(captive.portal)<--->FREERADIUS<--->OPENLDAP My problem now is between chilli and opendirectory THRU freeradius. Chilli supports chap or pap. I'm not able to use chap because, it's not compatible with openldap and I get as message error that I need a text-plain password. I'm not sure that using pap, it could be working. If I'm right, I'm able to convert the password to plain-text after chilli and before radius..., or am I wronging? Is there a way, I can authenticate my users from web-interface on opendirectory thru FREERADIUS? The other way could be kerberos but, if i have well understood, I'll get the same problem. Give me some help, please. Regards, Max
I forgot to say that LDAP is on MAC OSX, so it's Opendirectory, not the standard OPENLDAP... WEB.CLIENT<-->CHILLI<-->FREERADIUS<-->OPENDIRECTORY With radtest it works amazingly but not passing to chilli :( Regards.
Hi, I'm moving step by step to get my system working... My architecture is: WEB.CLIENT<--->CHILLI(captive.portal)<--->FREERADIUS<--->OPENLDAP My problem now is between chilli and opendirectory THRU freeradius. Chilli supports chap or pap. I'm not able to use chap because, it's not compatible with openldap and I get as message error that I need a text-plain password. I'm not sure that using pap, it could be working. If I'm right, I'm able to convert the password to plain-text after chilli and before radius..., or am I wronging? Is there a way, I can authenticate my users from web-interface on opendirectory thru FREERADIUS?
The other way could be kerberos but, if i have well understood, I'll get the same problem.
Give me some help, please.
Regards, Max - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Massimiliano Tommasi wrote:
If I'm right, I'm able to convert the password to plain-text after chilli and before radius..., or am I wronging?
No. It's impossible.
Is there a way, I can authenticate my users from web-interface on opendirectory thru FREERADIUS?
Fix Chillispot so that it sends User-Password, not CHAP-Password. Alan DeKok.
Chilli supports PAP and, if I'm right, the password is in clear-text. CHAP isn't invertible, this is clear. My only question is ... if it's possible to move from pap to opendirectory. The only way I have to authenticate is to pass clear-text to opendirectory but this doesn't happend :( Isn't enough PAP, Alan? Do you have any idea, where it's the mistake? Thanks Max Il 28/07/11 18.30, Alan DeKok ha scritto:
Massimiliano Tommasi wrote:
If I'm right, I'm able to convert the password to plain-text after chilli and before radius..., or am I wronging?
No. It's impossible.
Is there a way, I can authenticate my users from web-interface on opendirectory thru FREERADIUS?
Fix Chillispot so that it sends User-Password, not CHAP-Password.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Massimiliano Tommasi wrote:
My only question is ... if it's possible to move from pap to opendirectory. The only way I have to authenticate is to pass clear-text to opendirectory but this doesn't happend :( Isn't enough PAP, Alan?
Yes.
Do you have any idea, where it's the mistake?
No. Perhaps the debug log might help? Alan DeKok.
participants (2)
-
Alan DeKok -
Massimiliano Tommasi