eap authentication and proxy radius
It's possible configure Freeradius to request two eap authentication? For example, the supplicant starts the eap-tls and the authentication is ok. But the server radius don't send Access Accept but it requests a new authentication (for example eap-md5). If also eap-md5 is ok, the supplicant is authenticated. authentication supplicant = (authentication eap-tls) && (authentication eap-md5) If the first answer is Yes. It's possible that the first authentication is forwarded to remote radius server and the second one is resolved locally? authentication supplicant = (authentication eap-tls on remote radius server) && (authentication eap-md5 on proxy radius server) Many thanks, Matteo Paoli -- Matteo Paoli
Matteo Paoli <paoli@lenst.det.unifi.it> wrote:
For example, the supplicant starts the eap-tls and the authentication is ok. But the server radius don't send Access Accept but it requests a new authentication (for example eap-md5). If also eap-md5 is ok, the supplicant is authenticated.
No. EAP doesn't work like that. If that's what you want, I suggest PEAP with client certificates.
It's possible that the first authentication is forwarded to remote radius server and the second one is resolved locally?
RADIUS doesn't work like that. I have no idea what you're trying to do, but your proposed implementation doesn't match how supplicants, EAP, or RADIUS works. Alan DeKok.
participants (2)
-
Alan DeKok -
Matteo Paoli