Suffix authentication

[Sallee, Stephen (Jake)]

I have found a working solution for my environment and wanted to share
it with the list in case it may help someone else.

In my proxy.conf file I added the following
------------------
realm domainName1 {
}

Realm  domainName2{
}
------------------

That fixed my realm problem, not sure why...

We use Microsoft AD and ntlm_auth for authenticating our users through
MSCHAPv2 tunneled through a peap session.  I have 2 domains one is a
child of the other the FreeRADIUS server is joined to the parent domain
so it can authenticate users from both domains but passing the correct
domain for the user request was a bugger! In the end what I got to work
was modifying the ntlm_auth statement at the bottom of the mschap module
to be the following:

ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key
--username=%{%{Stripped-User-Name}:-%{User-Name:-None}}
--domain=%{outer.request:Realm}  --challenge=%{mschap:Challenge:-00}
--nt-response=%{mschap:NT-Response:-00}"

*** --domain=%{outer.request:Realm} was the key, now the realm of the
request is passed to the ntlm_auth script perfectly and the user is
authenticated like we all love them to be : )

This does seem to break the domain\username style of logging in though
... but due to time constraints this will have to do for now.

Thanks to everyone who everyone who helped out, especially Alan. Thank
you.


Jake Sallee
Godfather Of Bandwidth
Network Engineer

Fone: 254-295-4658
Phax: 254-295-4221



-----Original Message-----
From: freeradius-users-bounces+jake.sallee=umhb.edu at lists.freeradius.org
[mailto:freeradius-users-bounces+jake.sallee=umhb.edu at lists.freeradius.o
rg] On Behalf Of Alan DeKok
Sent: Tuesday, August 10, 2010 3:42 PM
To: FreeRadius users mailing list
Subject: Re: Suffix authentication

Sallee, Stephen (Jake) wrote:
> Quickly, my problem is users cannot log in using username at domain but 
> can login fine with domain\username.

 So... what is different in the debug log between the two requests?

> One person mentioned the realms module, but when I look at it the 
> default conf looks fine.  The delimiter is correctly set to '@'.  I 
> tried adding my domains to the realm module by copying the default 
> suffix config  and using my domain info but that causes FR to fail its

> sanity check.

  Because you made some random change without understanding how the
server works, or reading the documentation.

> I am using MSCHAPv2 with PEAP authentication and when the user fails 
> the logon with username at domain the ntlm_auth program reports a bad 
> password even though the same user will have no problem with
domain\username.
> 
> Also, the FR wiki says the realms file is depreciated ... so what am I

> supposed to do?

  Read proxy.conf.  It defines the realm names.  The "realms" module
just searches the User-Name in various ways (suffix, prefix, ntdomain),
and then sees if there is a matching realm.

> What would be really great would be a script I could use to determine 
> the domain of the user BEFORE they reach ntlm_auth so I can 
> prepopulate the command with the correct domain and just forget this
suffix stuff :
> )  I think the best place for this would be in the mschap module but 
> what is the language?  Would it be unlang or regular bash scripting?

  The default config documents how to define realms.

  Alan DeKok.
-
List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html