Authenticate users from Active Directory with UserPrincipalName or Mail with FreeRADIUS

Question

According to this documentation: http://deployingradius.com/documents/configuration/active_directory.html ; FreeRADIUS can authenticate Active Directory users using Samba's ntlm_auth, and in fact it works really well with the MSCHAPv2 protocol.

But using this method it's only possible to authenticate users with sAMAccountName from AD and we would like to authenticate users with it's userPrincipalName or email addresses.

How can I achieve this?

EDIT: Explaining better what I need. I need a way to parse the user login input. So if a user tries to login with an email address por example it will call a helper program to do a LDAP search and return the sAMAccountName to feed ntlm_auth. There's the FreeRADIUS preprocess module, but I don't know if I can use it for this purpose.

Post the `filter` attribute from the `ldap` section in your `radiusd.conf`, or maybe the entire ldap section actually — Mathias R. Jessen, Jul 31 '14 at 19:45
I'm not using `ldap`. Actually I was not aware that I can use `ldap` to authenticate within AD for MSCHAPv2 authentication. Can you point-me additional documentation? — Vinícius Ferrão, Jul 31 '14 at 19:52
Oh, just re-read the question. I'm pretty sure you can't do it with `ntlm_auth` as it doesn't seem to work with UPNs, but with ldap binds you can change the filter to search for users by userPrincipalName attributes — Mathias R. Jessen, Jul 31 '14 at 19:59
I can safely use the LDAP backend with AD? It will work for EAP/MSCHAPv2 for Wireless and Wired 802.1x Authentication? Thanks! — Vinícius Ferrão, Jul 31 '14 at 20:00
Well, don't use LDAP, use LDAP-over-SSL (tcp/636, tcp/3269 for GC). — Mathias R. Jessen, Jul 31 '14 at 20:02
Not really talking about the security scope, I'm afraid if it will work. RADIUS is very restrictive in supported authentication methods. According to this matrix only `ntlm_auth` is supported: http://deployingradius.com/documents/protocols/compatibility.html — Vinícius Ferrão, Jul 31 '14 at 20:06
It's not RADIUS which is restrictive, PAP will work with anything. And no you can't use LDAP to authenticate MSCHAPv2 with AD. — Arran Cudbard-Bell, Jul 31 '14 at 20:21

Authenticate users from Active Directory with UserPrincipalName or Mail with FreeRADIUS

0 Answers0