[RADIATOR] CHAP and Google Authenticator

[Heikki Vatiainen]

On 24.3.2022 21.51, dave at carrierip.net wrote:

> Meanwhile, now there is talk about using DUO! If that gets approved, we may
> pivot to that, at least for CHAP users, since my guess would be that DUO
> supports CHAP natively since there's no need to embed a PIN.

CHAP and its MSCHAP variants work with AuthBy DUO with certain limitations.

For example, there's no possibility to use the password to adjust how 
DUO authenticates the user. As an example, authenticating with MSCHAPv2 
and entering 'staticpassword,123456' to trigger DUO passcode 
authentication does not work because the client simply hashes 
'staticpassword,123456' and other values and sends the results over Radius.

What Radiator triggers is the DUO method configured with Radiator's 
DefaultFactor configuration parameter.

Thanks,
Heikki

-- 
Heikki Vatiainen
OSC, makers of Radiator
Visit radiatorsoftware.com for Radiator AAA server software