EAP-TTLS w/PAP using ntlm_auth

[Alan DeKok]

Bram Matthys (Syzop) wrote:
>>   You don't.  You've managed to put the "ntml_auth_pap" program into the
>> "pap" Auth-Type, for reasons I don't understand.  Why not just call it
>> ntlm_auth_pap?  After all, they're *different*.  The do NOT do the same
>> thing.
> 
> That's what I did first, because it makes sense and sounds logical, but
> didn't get it working, as said in my original mail: it ran the program
> succesfully but then simply went on with other mods and in the end
> complaining about no auth-type being set.

  I don't think you got my point.  If you want to AUTHENTICATE using
ntlm_auth_pap... then call it in the AUTHENTICATION section.  Calling it
in the AUTHORIZATION section is not AUTHENTICATION.

  You need to:

  a) set Auth-Type = ntlm_auth_pap in the authorize{} section
     which you are doing... sort of... using Auth-Type := PAP
  b) have an "Auth-Type ntlm_auth_pap" subsection in the authenticate{}
     section, which you are doing... sort of... using Auth-Type PAP.

> Could be that your suggestion there is for another type of configuration,
> but if that were the case then that wasn't clear to me.

  Yes.  Don't mangle the existing configuration.  PAP is for PAP.  If
you want a different Auth-Type, give it a different name.  There is
nothing magic about the PAP name.  You don't have to put all custom
authentication modules into the PAP subsection of the authenticate section.

  Alan DeKok.