MSCHAPv2 Module with Stripped-Username - no ActiveDirectory

[Markus Maurer]

Hi everybody,

I'd like to build an IPSec IKEV2 VPN with 2-factor authentication over EAP-Radius and MSCHAPv2.
The OTP should be placed in the "User-Name" attribute with a ":" as seperator. 
e.g.: <username>:<otp> - johndoe:123456
In the authorize section the User-Name attribute get splitted in two parts:
"Stripped-Username"
and
"User-OTP"
 if ( &User-Name =~ /^(.*):([0-9]{6})$/) {
               update request {
                        Stripped-User-Name := "%{1}"
                        User-OTP := "%{2}"
             }
       }

The first step is to authenticate the username with otp over rlm_perl.
If the first step succeeds, the eap module will be called and makes an mschapv2 authentication over sql (cleartext password).
And here is my problem. Whenever I get to this step, I get the following error:
"rlm_eap: Identity does not match User-Name, setting from EAP identity"
The eap module uses the original username (johndoe:123456) and password for the mschap challenge.
Is there any way to use the "Stripped-Username" for mschap without executing ntlm_auth? I dont need to authenticate against AD.

I cant attach my debug log as I havent access to the server right now but maybe someone could give me a hint. I have googled a lot and read some threads with a similar problem but they all are using AD auth with ntlm_auth.

Thanks for helping!!

Best Regards

 

-- 
This email was Malware checked by UTM 9. http://www.sophos.com