Re: Authentication Problem with PEAP and openldap
Hello Alan, thank you for your reply. The mapping of the NT-Password describe exactly our problem. We cannot find the right passage in the radius config to do this. Maybe you can give as a little hint, this would be very kindly. Best Regards, Michael
native wired xp 802.1X client with PEAP (mschapv2) tries to authenticate via freeradius against openldap with an md4 encoded utf-16e password hash. The authentication fails. If we use the hash instead of the clear-text password with the xp client, the authentication works fine. There must be some problems with the encryption of the password. How do we fix the problem? Any help is appreciated.
You may have the NT hash of the password in the LDAP database, but you're telling FreeRADIUS it's the clear-text password: ...
rlm_ldap: performing search in ou=XXX,ou=XXX,o=XXX,dc=XXX,dc=de, with filter (uid=plisch01) rlm_ldap: Added password 4183... in check items
You want to map this to the NT-Password attribute. Alan DeKok. -- Michael Poser, HRZ - Abteilung Netze Tel.:069/798-28052
Michael Poser wrote:
The mapping of the NT-Password describe exactly our problem. We cannot find the right passage in the radius config to do this. Maybe you can give as a little hint, this would be very kindly.
raddb/ldap.attrmap Alan DeKok.
You can also change the way passwords are stored in ldap. userPassword should have cleartext password. If you are going to store encrypted passwords you should use password header ({nt} in this case). If you store your passwords that way you just need to enable auto headers in pap module. pap module will then sort out password attribute. Ivan Kalik Kalik Informatika ISP Dana 12/1/2009, "Alan DeKok" <aland@deployingradius.com> piše:
Michael Poser wrote:
The mapping of the NT-Password describe exactly our problem. We cannot find the right passage in the radius config to do this. Maybe you can give as a little hint, this would be very kindly.
raddb/ldap.attrmap
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (3)
-
Alan DeKok -
Michael Poser -
tnt＠kalik.net