PEAP LDAP confusion

[Thibault Le Meur]

> Firstly, I am attempting to get XP/OSX clients to connect to a 802.1x 
> WLAN provided by a cisco wlan controller. This is currently backed by 
> ACS and works, but i'd like to use FreeRADIUS is possible, with half 
> my users in LDAP and half in MySQL.
>
> The setup uses PEAP, however am I correct in thinking that the RADIUS 
> server never touches any TLS components. The TLS tunnel is between 
> the WLAN controller and the client right?

Nope, the TLS tunnel starts at the client and ends at the Radius 
server: that's why the radius server needs a certificate (see the 
eap.conf file) and the client needs to check the radius server's 
certificate.

>
> Furthermore, I know I cannot use ldap authentication (binding) as a 
> result of the eap conversation,

True because PEAP implies a ms-chapv2 exchange that requires the 
knowledge of the NT-Hash (ldap used as an authorization backend and not 
an authentication module)

> however can I store an NT-Hash in LDAP/MySQL for the mschapv2 module 
> to pick up and use? I'd prefer not to store clear text at all if 
> possible...

Yes for Ldap (see ldapattr.map) that maps the radius internal attribute 
NT-Password to sambaNTPassword by default.

> I have everything I need compiled and installed, but I'd like to know 
> whether or not I can achieve my goal before wasting a lot of my time. 
> Any pointers are thus greatly appreciated.

see doc/rlm_ldap
ldapattr.map configuration file
and the ldap section of radiusd.conf

HTH,
Thibault