PEAP/EAP-MSCHAPv2 module modification problem

[Ivan Ostres]

On 5/23/13 2:59 PM, Alan DeKok wrote:
> Ivan Ostres wrote:
>> I am using PEAP-EAP-MSCHAPv2 combo with freeradius. I modified
>> EAP-MSCHAPv2 rlm to use a weird password store system
>    You should do that ONLY if the password store does MS-CHAP.
>
>    Otherwise, you should write a module to pull the password from the
> store, and let FreeRADIUS do the rest.
>
>
Hi Alan,

thanks for answering - I indeed have a weird setup here - I have 2 
external authentication systems:

(1) fast one acting as cache (that means it could have stale password info)
(2) slow one which always have a right password

The thing is that I need to use (1) whenever possible so I can do the 
lookup in (1) while in rlm_eap and simply do 
"pairmake_config("NT-Password",....). Then in eap-mschapv2 handler I 
need to check whether this password is ok (I can do that by checking 
response from peer and then if password appear to be wrong I need to 
contact (2) to check whether password is really wrong or just  (1) was 
wrong. If password in (2) is correct, I need to update record in (1).

Since I don't want to open new connection to (1) and (2) for every 
authentication I wanted to keep connections open in rlm_eap module 
instead in eap-mschapv2 handler but somehow I need to know whether 
password from (1) or (2) was eventually used to update (1) if needed - 
that;s why I asked how can I propagate info from eap-mschapv2 handler 
back to rlm_eap.

BR,
iostres