Alan, Thank you for your reply and please find my inline response below.
On Thu, Sep 26, 2013 at 7:54 PM, Alan DeKok <al...@deployingradius.com>wrote: > Don wrote: > > That said, if EAP-GTC can be used along with ntlm_auth how do I > > configure it to make that work? > > Read the "gtc" sub-section of eap.conf. It tells you how to make > EAP-GTC use a particular authentication method. > I tried one of these inside "gtc" sub-section of eap.conf, that don't seem to work: auth_type = ntlm_auth or ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{User-Name} --password=%{User-Password}" Though I haven't tried replacing User-Password with Cleartext-Password. Do I have to place this under "gtc" sub-section inside inner-eap? > > I tried to execute ntlm_auth passing > > --password=%{User-Password}, but that didn't work as User-Password is > > empty. > > You tried *where*? That matters. > See my comment earlier. Did I place the configuration at the right sub-section? > > > It says in eap.conf that GTC challenges the user with text and > > the response from the user is taken to be the User-Password. Perhaps I > > am executing ntlm_auth too early before GTC Password challenge is sent > > out and received the response. > > > > My questions are: > > 1. How can I configure freeRadius so GTC will work with ntlm_auth? > > a) configure ntlm_auth as per the deployingradius.com docs, and the > examples in the config files > Yes, I saw the ntlm_auth configuration under modules/mschap and modules/ntlm_auth. As stated in my first email, I am able to configure freeRadius to authenticate against our Active Directory using EAP-MSCHAPv2 (ntlm_auth) and I am looking to see if using EAP-GTC will work as well. > b) tell EAP-GTC to use ntlm_auth as per the examples in the gtc > configuration. As I mentioned earlier, I tried both auth_type = ntlm_auth nor ntlm_auth = "/usr/bin/ntlm_auth ..." command execution, but that don't work. > > 2. Is it possible to send subsequent GTC challenge in addition to > > default Password challenge? If possible, how do I configure the > > subsequent GTC challenge? > > No. EAP-GTC is only challenge-response. It doesn't do multiple > challenges. The reason I am asking the question of multiple challenges because I am currently evaluating another vendor solution for multi-factor authentication thru EAP-PEAP/TLS with EAP-GTC and the solution prompts 2 additional inputs during authentication. Here is the link: https://www.duosecurity.com/docs/netmotion. I thought if they can do it, freeRadius can do it as well. Alan DeKok. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > Regards, Dono
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html