Oauth2 Google?

[Phil Mayers]

On 02/24/2012 05:10 PM, Jesse Crayston wrote:
> Trying to get my users to have the same password on a radius server, as
> they do on the google apps domain.

That might be tricky.

Since you can't read the passwords from an apps domain, the only thing 
you could possibly do is use it as an "oracle" i.e. send it a 
username/password string, and get a yes/no reply.

This limits you to RADIUS methods that send a username/password - PAP, 
or EAP-TTLS/PAP. If you want to do 802.1x, you need an EAP method, which 
means EAP-TTLS/PAP, and this is not supported using the default windows 
supplicant.

If you do web-auth (captive portal) then you can do PAP. You will need 
to consult the docs for your captive portal for more info on that.

See here:

http://deployingradius.com/documents/protocols/oracles.html

...and for more info, here:

http://deployingradius.com/documents/protocols/compatibility.html


Assuming a PAP-based method works for you; there is no built-in support 
for using an OAuth IdP as an oracle. You would need to write a script 
and call it from FreeRADIUS, either via rlm_exec or inline as a 
perl/python script using rlm_perl/rlm_python.

Broadly, it would look something like this:

authorize {
   ...
   pap
}
authentication {
   Auth-Type PAP {
     my_script
   }
}

"my_script" might be an instance of rlm_exec, e.g. in 
raddb/modules/my_script:

exec my_script {
   wait = yes
   input_pairs = request
   program = "/path/to/script %{User-Name} %{User-Password}"
}

...and the script might be something like:

#!/bin/sh

USERNAME="$1"
PASSWORD="$2"
/do/outh_to_google $USERNAME $PASSWORD
if [ $? -eq 0 ]
then
   # auth success - return 0
   exit 0
else
   # auth failure - return 1
   exit 1
fi

See the example modules in raddb/echo and raddb/exec for more info on 
what external scripts can do and the return codes.

Cheers,
Phil