Hello, I am currently configuring a setup where an AD server is used to authenticate users via password _and_ supplemental attributes. So far I think I figured out that I need to use mschap {} with ntlm_auth to verify the password, but would need to use the ldap {} module to get the checkItems and replyItems I need to do the supplemental checking, and do the actual checking in the users file. Is that right? Secondly, I would like to use clear-text passwords in the Access-Request packets. Would the mschap module figure out things right automagically? As I see it, it only gets active and sets Auth-Type to MS-CHAP when it sees a Challenge in the Access-Request. Could this be one of the rare cases where I have to set Auth-Type manually (to MS-CHAP) get ntlm_auth running? Greetings, Stefan Winter -- Stefan WINTER Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingénieur de recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg email: stefan.winter@restena.lu tél.: +352 424409-1 http://www.restena.lu fax: +352 422473
Stefan Winter <freeradius-users-ml@stefan-winter.de> wrote:
So far I think I figured out that I need to use mschap {} with ntlm_auth to verify the password, but would need to use the ldap {} module to get the checkItems and replyItems I need to do the supplemental checking, and do the actual checking in the users file. Is that right?
Yes.
Secondly, I would like to use clear-text passwords in the Access-Request packets. Would the mschap module figure out things right automagically?
No. For that, you can list ldap in the authenticate section.
As I see it, it only gets active and sets Auth-Type to MS-CHAP when it sees a Challenge in the Access-Request. Could this be one of the rare cases where I have to set Auth-Type manually (to MS-CHAP) get ntlm_auth running?
You may set Auth-Type, but don't set it to MSCHAP. Set it to LDAP. Alan DeKok.
Hello,
Secondly, I would like to use clear-text passwords in the Access-Request packets. Would the mschap module figure out things right automagically?
No. For that, you can list ldap in the authenticate section.
As I see it, it only gets active and sets Auth-Type to MS-CHAP when it sees a Challenge in the Access-Request. Could this be one of the rare cases where I have to set Auth-Type manually (to MS-CHAP) get ntlm_auth running?
You may set Auth-Type, but don't set it to MSCHAP. Set it to LDAP.
authorize { mschap ldap files } and authenticate { Auth-Type LDAP { ldap } } right? Or would the mschap module be completely obsolete in this case? But then I don't understand why so many people complain that auth against Active Directory doesn't work with the LDAP module? Startled greetings, Stefan Winter -- Stefan WINTER Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingénieur de recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg email: stefan.winter@restena.lu tél.: +352 424409-1 http://www.restena.lu fax: +352 422473
Stefan Winter <freeradius-users-ml@stefan-winter.de> wrote:
You may set Auth-Type, but don't set it to MSCHAP. Set it to LDAP. ...
when the Access-Request contains a clear-text password.
But then I don't understand why so many people complain that auth against Active Directory doesn't work with the LDAP module?
LDAP "authentication" is "bind to ldap with username & password". This works for clear-text passwords. It doesn't work for MSCHAP. Alan DeKok.
participants (2)
-
Alan DeKok -
Stefan Winter