What is a difference "Auth-Type eap"(with Auth-Type) and "eap"(without Auth-Type) in the "authenticate" section?
Hello, members. Could you tell me what is a difference "Auth-Type eap"(with Auth-Type) and "eap"(without Auth-Type) in the "authenticate" section? Below is an example. What document should I read? Best regards. (1) MS-CHAP authenticate { # # MSCHAP authentication. Auth-Type MS-CHAP { mschap } # # For old names, too. # mschap } (2) EAP authenticate { eap # # The older configurations sent a number of attributes in # Access-Challenge packets, which wasn't strictly correct. # If you want to filter out these attributes, uncomment # the following lines. # Auth-Type eap { eap { handled = 1 } if (handled && (Response-Packet-Type == Access-Challenge)) { attr_filter.access_challenge.post-auth handled # override the "updated" code from attr_filter } } } Environment * OS: CentOS7 * FreeRADIUS: 3.0.13 -- Hiroyuki Sato
On Feb 19, 2019, at 7:47 AM, Hiroyuki Sato <hiroysato@gmail.com> wrote:
Could you tell me what is a difference "Auth-Type eap"(with Auth-Type) and "eap"(without Auth-Type) in the "authenticate" section? Below is an example. What document should I read?
https://networkradius.com/doc/FreeRADIUS-Technical-Guide.pdf Listing "eap" in the "authenticate" section just runs the "eap" module. If you want *multiple* things done in the "authenticate" section, you have to put them in an "Auth-Type ..." block.
(2) EAP authenticate {
eap
# # The older configurations sent a number of attributes in # Access-Challenge packets, which wasn't strictly correct. # If you want to filter out these attributes, uncomment # the following lines. # Auth-Type eap {
That section is commented-out in the default configuration. You can only use *one* of "eap" or "Auth-Type eap { ...}" in the "authenticate" section. Alan DeKok.
Hi, Thank you for your reply. Does this mean that the following configure are equal until I add multiline in "Auth-Type" block? Is this correct? authenticate { Auth-Type PAP { pap } } authenticate { pap } If so, I would like to know why mschap require two entries like the following? I'm not sure "For old names" mean. authenticate { # # MSCHAP authentication. Auth-Type MS-CHAP { mschap } # # For old names, too. # mschap } Best regards. 2019年2月19日(火) 22:15 Alan DeKok <aland@deployingradius.com>:
On Feb 19, 2019, at 7:47 AM, Hiroyuki Sato <hiroysato@gmail.com> wrote:
Could you tell me what is a difference "Auth-Type eap"(with Auth-Type) and "eap"(without Auth-Type) in the "authenticate" section? Below is an example. What document should I read?
https://networkradius.com/doc/FreeRADIUS-Technical-Guide.pdf
Listing "eap" in the "authenticate" section just runs the "eap" module.
If you want *multiple* things done in the "authenticate" section, you have to put them in an "Auth-Type ..." block.
(2) EAP authenticate {
eap
# # The older configurations sent a number of attributes in # Access-Challenge packets, which wasn't strictly correct. # If you want to filter out these attributes, uncomment # the following lines. # Auth-Type eap {
That section is commented-out in the default configuration. You can only use *one* of "eap" or "Auth-Type eap { ...}" in the "authenticate" section.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Hiroyuki Sato
On Feb 19, 2019, at 7:35 PM, Hiroyuki Sato <hiroysato@gmail.com> wrote
Does this mean that the following configure are equal until I add multiline in "Auth-Type" block? Is this correct?
Yes, that's what I said.
If so, I would like to know why mschap require two entries like the following? I'm not sure "For old names" mean.
Because the string "MS-CHAP" is different from the string "mschap". People use both names, so we provide configuration for both names so that they both work. Alan DeKok.
Hi, Thank you for your reply. I got it. Thank you. I would like to ask another question. Does this mean that there are equal? (But there is no strong reason to modify it. "mschap" is an old name.) Auth-Type MS-CHAP { mschap } Auth-Type mschap { mschap } And Auth-Type MS-CHAP { mschap } mschap 2019年2月20日(水) 10:07 Alan DeKok <aland@deployingradius.com>:
On Feb 19, 2019, at 7:35 PM, Hiroyuki Sato <hiroysato@gmail.com> wrote
Does this mean that the following configure are equal until I add multiline in "Auth-Type" block? Is this correct?
Yes, that's what I said.
If so, I would like to know why mschap require two entries like the following? I'm not sure "For old names" mean.
Because the string "MS-CHAP" is different from the string "mschap".
People use both names, so we provide configuration for both names so that they both work.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Hiroyuki Sato
participants (2)
-
Alan DeKok -
Hiroyuki Sato