[RADIATOR] Problem rewriting inner username with PEAP-MSCHAPV2

Hugh Irvine hugh at open.com.au
Tue Dec 23 05:01:35 CST 2008


Hello Matti, Hello Michael -

Correct - rather than use a RewriteUsername, you should use  
UsernameMatchesWithoutRealm in the inner AuthBy LSA clause.

regards

Hugh


On 23 Dec 2008, at 19:08, Matti Saarinen wrote:

> Michael Harlow wrote:
>
>> I'm trying to work our how to re-write the inner username for a TTLS
>> or PEAP request.
>>
>> [...]
>>
>> It seems to be working for TunnelledByTTLS/PAP, but not for
>> TunnelledByTTLS/MSCHAP-V2 and TunnelledByPEAP/MSCHAP-V2. Am I missing
>> something?
>
> I have understood that MSCHAPv2 packets contain checksum that is
> generated by the supplicant. Therefore the packets cannot be altered  
> by
> any intermediate RADIUS servers.
>
> -- 
> - Matti -
>
> _______________________________________________
> radiator mailing list
> radiator at open.com.au
> http://www.open.com.au/mailman/listinfo/radiator



NB:

Have you read the reference manual ("doc/ref.html")?
Have you searched the mailing list archive (www.open.com.au/archives/radiator)?
Have you had a quick look on Google (www.google.com)?
Have you included a copy of your configuration file (no secrets),
together with a trace 4 debug showing what is happening?
Have you checked the RadiusExpert wiki:
http://www.open.com.au/wiki/index.php/Main_Page

-- 
Radiator: the most portable, flexible and configurable RADIUS server
anywhere. Available on *NIX, *BSD, Windows, MacOS X.
Includes support for reliable RADIUS transport (RadSec),
and DIAMETER translation agent.
-
Nets: internetwork inventory and management - graphical, extensible,
flexible with hardware, software, platform and database independence.
-
CATool: Private Certificate Authority for Unix and Unix-like systems.




More information about the radiator mailing list