Username substitution via LDAP call possible?
Hello all, I am very new to Freeraduis, but, was doing a bunch of searching and I am coming up empty.... I would like to use Freeradius as a RADIUS proxy. I need a layer between our VMWare Horizon View system and Duo for 2-factor. Unfortunately, our users login with their UPN, which is not kept on our Duo instance. We also cannot use aliasing in the Duo system. So, we need it to take in an UPN (always an email address), and perform a LDAP lookup and then pass the users' CN or samAccountName on to our Duo authproxy RADIUS module. The server can run on Linux or Windows. Am I dreaming? Is this remotely doable? :) Thanks, Brian =============================== Brian Pedranti | Server Manager Information Technology Department | Harvard T.H. Chan School of Public Health 90 Smith St. Rm 212 | Boston, MA 02120 o: 617-998-6909 Join the conversation: News<http://www.hsph.harvard.edu/news> | Twitter<http://twitter.com/HarvardHSPH> | Facebook<http://www.facebook.com/harvardpublichealth> | LinkedIn<http://www.linkedin.com/edu/school?id=20305&trk=tyah> <http://www.linkedin.com/edu/school?id=20305&trk=tyah> | YouTube<http://www.youtube.com/user/HarvardPublicHealth> [Harvard T.H. Chan School of Public Health]<http://www.hsph.harvard.edu/>
On Tue, 2018-09-04 at 16:31 +0000, Pedranti, Brian wrote:
I would like to use Freeradius as a RADIUS proxy. I need a layer between our VMWare Horizon View system and Duo for 2-factor. Unfortunately, our users login with their UPN, which is not kept on our Duo instance. We also cannot use aliasing in the Duo system.
So, we need it to take in an UPN (always an email address), and perform a LDAP lookup and then pass the users' CN or samAccountName on to our Duo authproxy RADIUS module. The server can run on Linux or Windows.
Am I dreaming? Is this remotely doable? :)
If you're doing EAP, then probably not; you generally can't change the user name without things breaking. If not, then it's possibly OK. Configure rlm_ldap to look up the user, and then use unlang to update the User-Name attribute to the data returned in the appropriate LDAP attribute. Then proxy as usual. I've never used Horizon View or Duo, so no idea if it will actually work with them, though... -- Matthew
participants (2)
-
Matthew Newton -
Pedranti, Brian