When doing 802.1x authentication from a Windows computer it initially sends the request with the computer credentials. The username comes across as host/E4310-D7SZZN1.domain.local. I then query LDAP in authorize and do authentication against AD. In order to do both steps the username needs to be stripped to just E4310-D7SZZN1. I was able to accomplish this by placing the following in the authorize section if ("%{request:User-Name}" =~ /^host\/(.*).domain.local$/) { update request { Stripped-User-Name = "%{1}$" } } This worked just for the authentication section as it appears this happens after the LDAP module is called in authorize. How can I get this to happen earlier in the process? Right now I am looking at the proxy.conf file and setting a realm? Would this be the area to have this done?
Well I found something that appears to work. I used the hints file. And it correctly stripped off the host/ and domain.local. However now I get the error [eap] Identity does not match User-Name, setting from EAP Identity [eap] Failed in handler On Fri, Mar 15, 2013 at 3:29 PM, Matthew Ceroni <matthewceroni@gmail.com>wrote:
When doing 802.1x authentication from a Windows computer it initially sends the request with the computer credentials. The username comes across as host/E4310-D7SZZN1.domain.local. I then query LDAP in authorize and do authentication against AD.
In order to do both steps the username needs to be stripped to just E4310-D7SZZN1. I was able to accomplish this by placing the following in the authorize section
if ("%{request:User-Name}" =~ /^host\/(.*).domain.local$/) { update request { Stripped-User-Name = "%{1}$" } }
This worked just for the authentication section as it appears this happens after the LDAP module is called in authorize.
How can I get this to happen earlier in the process? Right now I am looking at the proxy.conf file and setting a realm? Would this be the area to have this done?
On 03/15/2013 10:47 PM, Matthew Ceroni wrote:
Well I found something that appears to work. I used the hints file. And it correctly stripped off the host/ and domain.local.
However now I get the error
[eap] Identity does not match User-Name, setting from EAP Identity [eap] Failed in handler
Modifying the "User-Name" attribute is a bad idea. It will, as you have seen, break EAP. Use another attribute - maybe define your own local one (see raddb/dictionary and pay attention to the comments about numbering). You were previously using Stripped-User-Name - just keep using that, and move the "unlang" you wrote to the top of the "authorize" section i.e.: authorize { if (User-Name =~ /^h.../) { ... } ... } One other alternative is to leave the username alone, and use the xlat provided by the mschap module; specifically this: %{mschap:User-Name} ...will expand this: host/name.domain.com ...to this: name$ Note the trailing dollar sign, which is windows-speak for "machine account". This is required if, for example, you use Samba/ntlm_auth, which requires "--username=host$" as the CLI argument. I'm not sure what any of this has to do with the subject line, btw...
Thanks. I will try this. The subject line was because I was trying to match it to a realm and thought by doing it that way I could get it to strip off what I needed. On Saturday, March 16, 2013, Phil Mayers <p.mayers@imperial.ac.uk> wrote:
On 03/15/2013 10:47 PM, Matthew Ceroni wrote:
Well I found something that appears to work. I used the hints file. And it correctly stripped off the host/ and domain.local.
However now I get the error
[eap] Identity does not match User-Name, setting from EAP Identity [eap] Failed in handler
Modifying the "User-Name" attribute is a bad idea. It will, as you have seen, break EAP.
Use another attribute - maybe define your own local one (see raddb/dictionary and pay attention to the comments about numbering).
You were previously using Stripped-User-Name - just keep using that, and move the "unlang" you wrote to the top of the "authorize" section i.e.:
authorize { if (User-Name =~ /^h.../) { ... } ... }
One other alternative is to leave the username alone, and use the xlat provided by the mschap module; specifically this:
%{mschap:User-Name}
...will expand this:
host/name.domain.com
...to this:
name$
Note the trailing dollar sign, which is windows-speak for "machine account". This is required if, for example, you use Samba/ntlm_auth, which requires "--username=host$" as the CLI argument.
I'm not sure what any of this has to do with the subject line, btw... - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (2)
-
Matthew Ceroni -
Phil Mayers