LDAP/MSCHAP

[Alan DeKok]

Gary Gatten wrote:
> I agree with Jake, in that I *think* it would be possible to have a plugin or whatever interface with LDAP/AD in the same manner ntlm_auth does.

  It's possible to have a plugin, but there is no benefit.  FreeRADIUS
already has an LDAP plugin.

  The *only* reason for ntlm_auth is that Microsoft doesn't expose the
NT-Password over LDAP.

>  I don't think one *needs* a cleartext password, but does need some way to compare apples-to-apples.  That said, I don't know the inner workings of all the auth protocols involved here so I could be way off.  Something tells me if it were easy/possible, Mr. DeKok would have likely written the plugin by now.

http://deployingradius.com/documents/protocols/compatibility.html

  This hasn't changed in 15 years.

  Alan DeKok.