On Tue, Dec 2, 2014 at 9:52 AM, Heiko O <puettagoras@gmail.com> wrote:

Hello all,

i have two question on realms:

Authenication works fine when Users only enter "username",but i want the users to login with something like "username@thedomain.net". But when doing this i get

(0) preprocess : --> testuser (0) [preprocess] = ok (0) [chap] = noop (0) mschap : Found MS-CHAP attributes. Setting 'Auth-Type = mschap' (0) [mschap] = ok (0) [digest] = noop (0) suffix : Checking for suffix after "@" (0) suffix : No '@' in User-Name = "testuser", looking up realm NULL (0) suffix : No such realm "NULL" (0) [suffix] = noop (0) eap : No EAP-Message, not doing EAP (0) [eap] = noop (0) sql : EXPAND %{User-Name} (0) sql : --> testuser (0) sql : SQL-User-Name set to 'testuser' rlm_sql (sql): Reserved connection (4) (0) sql : EXPAND SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id (0) sql : --> SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = 'testuser' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = 'testuser' ORDER BY id' rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 5 (0) sql : User found in radcheck table (0) sql : Check items matched (0) sql : EXPAND SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id (0) sql : --> SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = 'testuser' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = 'testuser' ORDER BY id' rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 2 , fields = 5 (0) sql : User found in radreply table (0) sql : EXPAND SELECT GroupName FROM radusergroup WHERE UserName='%{SQL-User-Name}' ORDER BY priority (0) sql : --> SELECT GroupName FROM radusergroup WHERE UserName='testuser' ORDER BY priority rlm_sql (sql): Executing query: 'SELECT GroupName FROM radusergroup WHERE UserName='testuser' ORDER BY priority' rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 1 (0) sql : User not found in any groups rlm_sql (sql): Released connection (4) (0) [sql] = ok (0) [expiration] = noop (0) [logintime] = noop (0) } # authorize = ok (0) Found Auth-Type = MSCHAP (0) # Executing group from file /etc/raddb/sites-enabled/default (0) Auth-Type MS-CHAP { (0) mschap : Found Cleartext-Password, hashing to create LM-Password (0) mschap : Found Cleartext-Password, hashing to create NT-Password (0) mschap : Creating challenge hash with username: testuser (0) mschap : Client is using MS-CHAPv2 (0) ERROR: mschap : MS-CHAP2-Response is incorrect (0) [mschap] = reject (0) } # Auth-Type MS-CHAP = reject (0) Failed to authenticate the user

I did a lot of try-and-error with suffix ans Strip and configuring, but i can't get mschap to work. How can I teach mschap to work with "user@thedomain.net"? BTW: The radcheck-table contains simply "username" with no realms, and that cannot be changed.

all my users must provide whatever@domain.com, and this is working fine. I don't use SQL but my backend password server is AD

I have this regex in my site-enabled/default authorized section if (User-Name =~ /^([^@]*)@([-A-Z0-9]+(\\.[-A-Z0-9]+)+)$/i) { So if user do not supply whatever@domain.com I just simply reject, there are number of discussion on this.

The second question is about proxying. Since the is only one RADIUS-Server, proxying is not needed. I wonder if i really have to add a realm and proxy the request to localhost. Is there a way to say "Hey, just answer all queries with @thedomain.org and don't proxy it to yourself"?

similarly, you can achieve this with regex as well.

if ( Realm == "thedomain.org") { update control { Proxy-To-Realm := LOCAL } else { ... reject }

Thanks for your help and suggestions. Heiko - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

On 02/12/14 09:52, Heiko O wrote:

(0) mschap : Creating challenge hash with username: testuser (0) mschap : Client is using MS-CHAPv2 (0) ERROR: mschap : MS-CHAP2-Response is incorrect (0) [mschap] = reject (0) } # Auth-Type MS-CHAP = reject (0) Failed to authenticate the user

I did a lot of try-and-error with suffix ans Strip and configuring, but i can't get mschap to work. How can I teach mschap to work with "user@thedomain.net"?

You don't. The MSCHAP RFCs don't specify this but all clients (AFAIK) turn "user@domain" into "user" before doing the MSCHAP crypto, which is analogous to turning "DOMAIN\user" into "user" (which the RFCs do specify). As you can see from the "Creating challenge hash", the mschap module is using the right username i.e. with domain stripped. So your config is fine. Check the password hash.