On Tue, 2013-03-26 at 14:13 +0000, Phil Mayers wrote:
> On 26/03/2013 12:50, John Horne wrote:
> > Hello,
> >
> > Using Freeradius 2.1.10 I have been trying to see if I can proxy a
> > request to a remote server but using a different User-Name attribute
> > based on the original request User-Name attribute.
>
> You can do this, but it might break things because you're using EAP.
>
Yes, it seems that just changing the 'User-Name' attribute results in
authentication failures (no doubt due to EAP breaking).
> What is the upstream proxy?
>
Microsoft domain controller (DC).
> Can you explain why you want to do this? Obviously it's possible to
> manipulate the packet in many ways, but your goal may be best
> accomplished via a different route.
> -
The DC will recognise a users userid (e.g. 'jbloggs') provided it has no
realm. It will also recognise (what I think is the UPN?) which is of the
form 'j.blo...@plymouth.ac.uk'.
However, we have to cater for a mixed format of
'jblo...@plymouth.ac.uk', which is currently used by some users and
working. To do this we need to strip off the realm so that the DC will
recognise just the userid part ('jbloggs'). (For completeness, the
format 'j.bloggs' with no realm is not allowed by us and rejected.)
John.
--
John Horne, Plymouth University, UK
Tel: +44 (0)1752 587287 Fax: +44 (0)1752 587001
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
