Chromebooks, FreeRADIUS and Google Workspace (i.e. G Suites) for 802.1X.

[Robert Montgomery]

Hi Everyone,

I think I know my answer, but I figured I would just try to validate /
document.

I have customers that use Google Workspace as their primary user database
(they're schools). I've been attempting to use FreeRADIUS as middleware to
allow the WiFi network to perform an 802.1X authentication against the LDAP
service provided by Google. It works well for some clients, but not for
Chromebooks.

I think the root cause of the issue is FreeRADIUS' need to get an
unencrypted copy of the password. Because Google Workspace encrypts the
user's passwords, authentication only works if the client sends an
unencrypted password to FreeRADIUS. To do that, it needs to support the
EAP-GTC method. And, while most clients support EAP-GTC, Chromebooks do not.

Am I missing something? Has anyone figured out a way to use 802.1X to
authenticate Chromebooks against Google Workspace LDAP? (Just figured I'd
ask. :-D)

Thanks,

-Rob