User name case insensitivity - revisited

[Matthew Newton]

On 11/06/2022 19:21, Luveh Keraph wrote:
> I thought I had grasped what is involved in making FreeRADIUS 3.0.* to
> process user names in a case-insensitive way, but I am not so sure now.
> Here is what I have done:
> 
> First, I added the following line in my /etc/raddb/mods-enabled/files:
> 
>      key = "%{%{Stripped-User-Name}:-%{tolower:%{User-Name}}}"

i.e. "look up Stripped-User-Name in whatever case it is in, but if that 
doesn't exist convert the full User-Name to lowercase and look that up 
instead.

I doubt that's what you want - probably tolower both of them.

> I have the following entry in my /etc/raddb/users file:
> 
> ijk_user1 User-Password != "IJKpassword1"
> ijk_user1 Cleartext-Password := "IJKpassword1"

Why the first line? That doesn't make any sense. Just the second line.


> With this, when I try to ssh as IJK_User1 (notice the mixed case) into a
> system that turns over authentication to my FreeRADIUS server, I get the
> following debugging information at this server:

Don't use any more than just -X. The extra -x's just make everything 
hard to read, for no benefit.

> Which is fine: the user name gets converted from IJK_User1 to ijk_user1 and
> the authentication with password IJKpassword1 succeeds, as expected.

OK...


> I then changed  the relevant entry in my /etc/raddb/users file as follows:
> 
> IJK_User1 User-Password != "IJKpassword1"
> IJK_User1 Cleartext-Password := "IJKpassword1"

So you're looking up a lowercase username, compared against a username 
with uppercase characters in it. Doubt that will go well.


> Sat Jun 11 11:48:54 2022 : WARNING: (0) pap: No "known good" password found > for the user.  Not setting Auth-Type

Hmm, nope. It didn't.

> If I understand things correctly, the key = ... line that I added to the
> files file does indeed recast the incoming user name to lowercase. However,
> the FreeRADIUS server still compares incoming user names against those in
> the users file in a case sensitive way.  This is fine, but not quite what I
> was looking for.
> 
> Is it possible to get FreeRADIUS to compare user names (and user
> names alone - not passwords)  in a real case-insensitive way against those
> in the /etc/raddb/users file?

You control the users file. Write the entries there in lower case, then 
the lowercase username will match.

-- 
Matthew