Restrict authentication types per user
Hi, I want to test a supplicant. I'm looking for a way to restrict the allowed authentication types per user. Only one special authentication type per user. I know that it is a stupid thing to do, but I need it for testing. E.g. user1 is only allowed to use EAP-TLS user2 is only allowed to use EAP-TTLS/EAP-MSCHAPv2 user3 is only allowed to use EAP-TTLS/MSCHAPv2 .. Is there an easy way to do this? I'm using a standard installation of version 3.0.11. Thanks, Yolanda Fischer --- Mail & Cloud Made in Germany mit 3 GB Speicher! https://email.freenet.de/mail/Uebersicht?epid=e9900000450
On Apr 20, 2016, at 5:18 AM, yolanda3000@freenet.de wrote:
I want to test a supplicant. I'm looking for a way to restrict the allowed authentication types per user. Only one special authentication type per user. I know that it is a stupid thing to do, but I need it for testing.
The best way is to force a reject if any other authentication method is used. You can't really force one method, because the client can NAK any method you choose, and pick another one. authorize { ... eap if ((User-Name == "user1") && (EAP-Type != EAP-TLS)) { reject } ... } Alan DeKok.
Hi,
The best way is to force a reject if any other authentication method is used. You can't really force one method, because the client can NAK any method you choose, and pick another one.
reject is fail....and client would just try again....and again.... what you want to do, its for a particular user, NAK that EAP type so the client DOES try another one... which means.....you need to use different inner-tunnels, with different available EAP types available in each, for each type/class of user.... alan
On Apr 20, 2016, at 9:21 AM, A.L.M.Buxey@lboro.ac.uk wrote:
reject is fail....and client would just try again....and again.... what you want to do, its for a particular user, NAK that EAP type so the client DOES try another one...
That may help... but it's still a negotiation.
which means.....you need to use different inner-tunnels, with different available EAP types available in each, for each type/class of user....
I don't think that's necessary. But it is necessary to send custom NAKs back... which isn't supported right now. Alan DeKok.
participants (3)
-
A.L.M.Buxey＠lboro.ac.uk -
Alan DeKok -
yolanda3000＠freenet.de