Radius-based windows authentication

[Phil Mayers]

Julien MIOTTE wrote:
>>   1. Using the windows native supplicant and machine account
>> authentication. Basically the process is this:
>>      * machine powers on - no-one logged in
>>      * machine uses its own domain account to login "host/$machinename"
>>      * user presses ctrl+alt+del
>>      * machine validates credentials to the domain controller, over the
>> current network connection
>>      * machine downloads the users profile
>>      * once the profile is download, the machine does an EAP-Logoff and
>> then re-authenticates using the user credentials
>>      * when the user logs out, the machine does and EAP-Logoff and then
>> logs back in using the machine account
> 
> Hi, I've been trying to do as you told me.

There's no need to CC me. I read the list.

> Using the native supplicant and MSCHAPv2 on PEAP, the machine sends now it's 
> own credentials. My problem is that the login is sent with the 
> prefix "host/". In my LDAP, the entry of the machine is machine_name$.
> 
> I tried to fix this trough various ways, and I succeded by adding an entry in 
> the hint file :
> 	DEFAULT Prefix == "host/", Strip-User-Name = "Yes"
> 
> and by changing the filter in the LDAP section :
> 	filter="(uid=%{Stripped-User-Name:-%{User-Name}})"  
> to 
> 	filter="(uid=%{Stripped-User-Name:-%{User-Name}}$)"
> 
> Now the authorization works fine, but when the authenticate section is 
> processed, the debug prints this :
> 	rlm_eap: Identity does not match User-Name, setting from EAP Identity.
> 
> Am I doing all of this right ?
>  

There's a better way; use the mschap module expansion function, which 
will both strip and suffix for you:

filter = "(uid=%{mschap:User-Name})"