0

I am currently configuring a linux server with Freeradius to have our clients authenticate against our Active Directory for our WiFi-network.

The goal is to have our users use the e-mail address that is present the Active Directory as the 'mail' attribute and their domain password to authenticate to the WiFi network.

The format of our AD naming is as follows

name: Joe Jonssen username: foo\jjon1 UPN: jjon1@foo.bar.lan mail address: j.jonssen@company.com

I currently have ntlm_auth working and am able to login with jjon1 and the password. But we want to login with j.jonssen@company.com and the password.

Is there any way to achieve this, I am not bound to Freeradius as Radius server. We need to use our mail address as username for the WiFi network because we are thinking about joining an initiative like Eduroam and logging in with mail address is required.

0

You can find out the Username/sAMAccountName by starting a LDAP query to the AD and then performing the NTLM-Authentication.

A very basic bash script mail_to_username (without any input filter) would look like this:

#!/bin/bash

MAIL=$1
NTDOMAIN=$2
CHALLENGE=$3
NTRESPONSE=$4

HOST="ldap://ip-adress"
BASE_DN="OU=Users,DC=example,DC=de"
BIND_DN="LDAP-freeradius@example.de"
PASSWORD="x"
FILTER="mail=$MAIL"

sAMAccountName=`ldapsearch -LLL -x -D "$BIND_DN" -w "$PASSWORD" -b "$BASE_DN" -H "$HOST" "$FILTER" sAMAccountName | grep sAMAccountName | awk '{print $2}'`

/usr/bin/ntlm_auth --request-nt-key --username=$sAMAccountName --domain=$NTDOMAIN --challenge=$CHALLENGE --nt-response=$NTRESPONSE

inside the mschap-module you call the bash-script instead of calling directly ntlm_auth:

ntlm_auth = "/usr/bin/mail_to_username %{mschap:User-Name:-None} %{%{mschap:NT-Domain}:-EXAMPLE} %{mschap:Challenge:-00} %{mschap:NT-Response:-00}"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.