Freeradius, Eduroam, AzureAD ldaps authentication
niels at ixs.ph
Wed Jun 9 13:03:59 CEST 2021
Not just when using freeradius. For almost any scenario that I have had to
deal with I still needed a local windows server running active directory to
use the AD connect tool with. Pure aadds doesn't really work well if you
still have anything on-prem.
I went with what Alan just suggested.
On Wed, Jun 9, 2021, 18:38 Alan DeKok, <aland at deployingradius.com> wrote:
> On Jun 9, 2021, at 6:24 AM, Tanya Stawicki <tanyastawicki at gmail.com>
> > We have a Freeradius server two years long successfully providing EduRoam
> > connectivity for our customer.
> > Local Identity provider is Microsoft Server 2016 AD. WiFi clients are
> > most Windows 10 clients and phones.
> > However the customer wants to switch to Azure AD and ( in time) get rid
> > their Windows servers. They want to authenticate with Azure AADDS Ldaps
> > I doubt if it is possible with (Free)Radius, I guess the combination is
> > in the compatibility matrix, but I’m not sure: It’s not 100% clear to
> > which encryption method Azure uses for storing passwords in LDAPs.
> Most likely NT-Password. But you should mostly treat it like Active
> > Question 1. is it possible FreeRadius for wifi-auth. with Azure AD as
> Yes. Sometimes. Depending on the authentication method.
> > I have set up an other EduRoam FreeRadius server anyway:
> > What works:
> > - ldapsearch -H ldaps.mydomain.nl -x -b “dc=mydomain,dc=nl”
> > - radtest abba.king at mydomain <userpassword> 127.0.0.1 -1 testing123 -
> > "Received Access-Accept"
> Yes. Because you're sending a clear-text password. Which FreeRADIUS
> sends to Azure, and Azure checks it.
> > What doesnt work:
> > - Authentication with WiFi (on windows 10 PC with native eap-peap /
> > mschapv2 ) error:
> Because Azure won't give the clear-text password or NT-Password to
> FreeRADIUS. So FreeRADIUS can't do the MS-CHAP calculations.
> > Did I make a mistake? Or is it not possible?
> It's not really possible. Microsoft makes it difficult.
> What is possible is to set up a local Active Directory solution which
> syncs with Azure. Then, use Samba locally to talk to AD.
> Alan DeKok.
> List info/subscribe/unsubscribe? See
More information about the Freeradius-Users