Hi all,
I have a question that some coworkers and I have been unable to answer
in the last few weeks and we are hoping to have your insight. Here are
the details (if I leave something important out, please let me know):
We are running radiusd: FreeRADIUS Version 1.1.7, for host
sparc-sun-solaris2.10
Currently we have TTLS/PAP authentication setup and working just fine.
Some authentication occurs locally, while other realms are proxied off
to another radius server that share a secret with us, but all TTLS
tunnels are terminated by our freeradius box and then proxying is done
radius to radius server.
In the near future we will have some AD servers (LDAP) which will
authenticate enterprise-wide credentials that are being issued to
everyone on campus. In lab, we have made PEAP terminate on freeradius
and then have used ntlm_auth & samba to proxy ms_chap out to the AD
server for authentication.
What we are wondering is if its possible to still have requests come
through to our freeradius box, and instead of providing the certificate
and proxying the contents of the inner tunnel to the AD box.. if its
possible to simply proxy the entire request, PEAP/MSCHAP and all
directly to their AD servers? They are hesitant to allow our freeradius
box to join the domain, and if its doable, a workaround would be the
preferred route.
I hope this makes sense and thanks for any help offered.
Sincerely,
Max
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
