MSCHAP authentication against Active directory OR MySQL

[Alan DeKok]

Krzysztof Grobelak wrote:
> On my freeRADIUS instance i am able to authenticate MSCHAP requests
> against Active Directory using the ntlm_auth module and Samba
> aditionally i can authenticate another group of WiMAX devices with
> MACHAP against MySQL database. But if I enable the config for WiMAX
> devices the are being authenticated aginst Active Directory and not
> the MySQL db. Now I would like to be able to configure the server so
> that both groups can be authenticated local users against Active
> Directory and the WiMAX devices against database.

  That should be simple enough to do.

> Can you guys advice how i can make it happen? I suspect unlang will be
> needed to do this but if you could specify how exactly it would be
> awesome.

  Well... reading the docs && debug logs should help a lot.

> would it be something along those lines??
> 
> authorise{
> 	mschap{

  No.  That won't work.

> 		if("%{NAS-IP-Address}" == "1.1.1.1"){

  There's no need to put everything in quotes.

> 			sql
> 		}
> 		else{
> 			ntlm_auth
> 		}
> 	}
> }

  You should be able to just do this:

authorize {
	...

	if (NAS-IP-Address == 1.1.1.1) {
		sql
		update control {
			MS-CHAP-Use-NTLM-Auth = No
		}
	}
	...
}

  And configure the "mschap" module, the "ntlm_auth" entry.

  Alan DeKok.