MSCHAP authentication against Active directory OR MySQL
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello All, On my freeRADIUS instance i am able to authenticate MSCHAP requests against Active Directory using the ntlm_auth module and Samba aditionally i can authenticate another group of WiMAX devices with MACHAP against MySQL database. But if I enable the config for WiMAX devices the are being authenticated aginst Active Directory and not the MySQL db. Now I would like to be able to configure the server so that both groups can be authenticated local users against Active Directory and the WiMAX devices against database. Can you guys advice how i can make it happen? I suspect unlang will be needed to do this but if you could specify how exactly it would be awesome. would it be something along those lines?? authorise{ mschap{ if("%{NAS-IP-Address}" == "1.1.1.1"){ sql } else{ ntlm_auth } } } I hope I did not mixed up terminology too much ;) Regards, Krzysztof -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.13 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQEcBAEBAgAGBQJTma/YAAoJEM/U1HoKR/xkaq0IAJOcPRpsH61wh8sVHrafl0da mCVYN/T94FRSVsOgRtpCpz3zKtfiorla2bL06RN+EQhPxtyist8dX1xNyUnzETaR QcY+/OCDHtVtWX4GGiOMP75DaUNDOj76NtAGLZOe+48Jtjvv3aoSCO4MZgUhbIbN wY4vKxeuA5PJ0SVQD1D8rWIKxxZNwLj24gCowpAA9TJsS1qpqZfLMwYd+uu/vo1O 1ztX7rhkzFdNAn8fJkIpHQLPad0PcAohHevbwIzgivHBtM2euYHvgjFY7yQurSXh G0WuoeWSri3oc3QriTiMc+wIQb1QTSvyTzZwjXhcdB3D0NGJKe3MIPJfCQDIk80= =Fhp6 -----END PGP SIGNATURE----- Airspeed Telecom
Krzysztof Grobelak wrote:
On my freeRADIUS instance i am able to authenticate MSCHAP requests against Active Directory using the ntlm_auth module and Samba aditionally i can authenticate another group of WiMAX devices with MACHAP against MySQL database. But if I enable the config for WiMAX devices the are being authenticated aginst Active Directory and not the MySQL db. Now I would like to be able to configure the server so that both groups can be authenticated local users against Active Directory and the WiMAX devices against database.
That should be simple enough to do.
Can you guys advice how i can make it happen? I suspect unlang will be needed to do this but if you could specify how exactly it would be awesome.
Well... reading the docs && debug logs should help a lot.
would it be something along those lines??
authorise{ mschap{
No. That won't work.
if("%{NAS-IP-Address}" == "1.1.1.1"){
There's no need to put everything in quotes.
sql } else{ ntlm_auth } } }
You should be able to just do this: authorize { ... if (NAS-IP-Address == 1.1.1.1) { sql update control { MS-CHAP-Use-NTLM-Auth = No } } ... } And configure the "mschap" module, the "ntlm_auth" entry. Alan DeKok.
On 12/06/14 14:59, Alan DeKok wrote:
Krzysztof Grobelak wrote:
On my freeRADIUS instance i am able to authenticate MSCHAP requests against Active Directory using the ntlm_auth module and Samba aditionally i can authenticate another group of WiMAX devices with MACHAP against MySQL database. But if I enable the config for WiMAX devices the are being authenticated aginst Active Directory and not the MySQL db. Now I would like to be able to configure the server so that both groups can be authenticated local users against Active Directory and the WiMAX devices against database.
That should be simple enough to do.
Can you guys advice how i can make it happen? I suspect unlang will be needed to do this but if you could specify how exactly it would be awesome.
Well... reading the docs && debug logs should help a lot.
would it be something along those lines??
authorise{ mschap{
No. That won't work.
if("%{NAS-IP-Address}" == "1.1.1.1"){
There's no need to put everything in quotes.
sql } else{ ntlm_auth } } }
You should be able to just do this:
authorize { ...
if (NAS-IP-Address == 1.1.1.1) { sql update control { MS-CHAP-Use-NTLM-Auth = No } } ... }
And configure the "mschap" module, the "ntlm_auth" entry.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
That worked perfectly!!! Thanks a lot Alan. Regards Krzysztof Airspeed Telecom
participants (2)
-
Alan DeKok -
Krzysztof Grobelak