Re: Quick question regarding FR auth against MS AD
Sender: Freeradius-Users <freeradius-users-bounces+275972560=qq.com@lists.freeradius.org> Alan DeKok Date: Thursday, April 22, 2021 4:24 AM Receipt: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: Quick question regarding FR auth against MS AD
Install Samba on another machine, and point FreeRADIUS at that. There really is no other choice than to use Samba for PEAP with Active Directory.
Thanks for quick response, Alan. I want to say that was my expecting answer, but per talking with my colleague, he said that the mschap challenge auth can be somehow proxy or transfer from supplicant to MS AD by radius, just the like the trick of ldap bind auth itself, this is what I'm curious about, is this even operational?
On Apr 23, 2021, at 2:18 AM, <275972560@qq.com> <275972560@qq.com> wrote:
I want to say that was my expecting answer, but per talking with my colleague, he said that the mschap challenge auth can be somehow proxy or transfer from supplicant to MS AD by radius, just the like the trick of ldap bind auth itself, this is what I'm curious about, is this even operational?
If he knows the answer already, why are you asking me? Go ask him how he does it. Alan DeKok.
On 23/04/2021 11:20, Alan DeKok wrote:
On Apr 23, 2021, at 2:18 AM, <275972560@qq.com> <275972560@qq.com> wrote:
I want to say that was my expecting answer, but per talking with my colleague, he said that the mschap challenge auth can be somehow proxy or transfer from supplicant to MS AD by radius, just the like the trick of ldap bind auth itself, this is what I'm curious about, is this even operational?
If he knows the answer already, why are you asking me? Go ask him how he does it.
Sounds like he's probably running a Microsoft RADIUS server in Windows, and proxying over to that to do the auth. Which isn't FreeRADIUS authenticating against AD. It's just proxying to another RADIUS server that is. -- Matthew
Sender: Freeradius-Users <freeradius-users-bounces+275972560=qq.com@lists.freeradius.org> 代表 Matthew Newton Sent: Friday, April 23, 2021 6:30 PM Receipt: freeradius-users@lists.freeradius.org Subject: Re: Quick question regarding FR auth against MS AD
If he knows the answer already, why are you asking me? Go ask him how he does it.
That's the point, I'm frustrated to communicate, he insists on this but don't bother to spell a word, if I ask he would telling me reading the doc in freeradius.org, that's all in the manual...
Sounds like he's probably running a Microsoft RADIUS server in Windows, and proxying over to that to do the auth. Which isn't FreeRADIUS authenticating against AD. It's just proxying to another RADIUS server that is.
No, he told me he will NEVER(emphasis) use Microsoft NPS or Cisco ISE, so I'm sure this is not the case.
On Apr 25, 2021, at 4:19 AM, <275972560@qq.com> <275972560@qq.com> wrote:
That's the point, I'm frustrated to communicate, he insists on this but don't bother to spell a word, if I ask he would telling me reading the doc in freeradius.org, that's all in the manual...
Then your "friend" is lying to you. Alan DeKok.
participants (3)
-
275972560＠qq.com -
Alan DeKok -
Matthew Newton