<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Why would we need to do any rejections in TunnelledByPEAP=1? We have this in there:</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<AuthBy FILE>
<div> EAPType MSCHAP-V2</div>
<div> EAP_PEAP_MSCHAP_Convert 1</div>
</AuthBy><br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
So we need two Handler ConvertedFromEAPMSCHAPV2=1 then. One to handle uic.edu and empty realms (with a very fancy regexp) and then one to handle the rejection of other domains.</div>
<div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature">
<div>
<div></div>
<div id="divtagdefaultwrapper" style="font-size:12pt; color:#000000; background-color:#FFFFFF; font-family:Calibri,Arial,Helvetica,sans-serif">
<div style="font-family:Tahoma; font-size:13px">---
<div><span id="ms-rterangepaste-start"></span><span style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">Roberto Ullfig - rullfig@uic.edu</span><br style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">Systems Administrator</span><br style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">Enterprise Applications & Services | Technology Solutions</span><br style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">University of Illinois - Chicago</span>
<div><span id="ms-rterangepaste-end"></span></div>
</div>
</div>
</div>
</div>
</div>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> radiator <radiator-bounces@lists.open.com.au> on behalf of Heikki Vatiainen <hvn@open.com.au><br>
<b>Sent:</b> Friday, January 7, 2022 7:29 AM<br>
<b>To:</b> radiator@lists.open.com.au <radiator@lists.open.com.au><br>
<b>Subject:</b> Re: [RADIATOR] Simple Question Regarding Realm Handling</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">On 6.1.2022 17.37, Ullfig, Roberto Alfredo wrote:<br>
<br>
> We are now using UsernameMatchesWithoutRealm whereas before we required <br>
> the domain not be included.<br>
> <br>
> <Handler ConvertedFromEAPMSCHAPV2=1><br>
> ...<br>
> <AuthBy NTLM><br>
> UsernameMatchesWithoutRealm<br>
> DefaultDomain AD<br>
> </AuthBy><br>
> <br>
> But I believe this will strip remote domains as well - so someone could <br>
> enter a remote domain and it would still work (as long as they have an <br>
> account locally of course).<br>
<br>
Yes, I think that would happen. It would look odd in the logs, but would <br>
require a valid local account for which the user knows the credentials, <br>
as you wrote.<br>
<br>
> Would adding a new handler above like the <br>
> following fix this?<br>
> <br>
> <Handler ConvertedFromEAPMSCHAPV2=1 Realm=/^(?:.+\.)*uic\.edu$/i><br>
<br>
Syntax: Add a comma and a minor regexp update to match absolute line end:<br>
<br>
<Handler ConvertedFromEAPMSCHAPV2=1, Realm=/^(?:.+\.)*uic\.edu\z/i><br>
<br>
> ...<br>
> <AuthBy NTLM><br>
> UsernameMatchesWithoutRealm<br>
> DefaultDomain AD<br>
> </AuthBy><br>
> <br>
> We want to allow both username and username@uic.edu - but not accept <br>
> something like username@usa.gov.<br>
<br>
I'd say the regexp wouldn't match realmless username, but something like <br>
this should do it. See and try with the tester below:<br>
<br>
Simplified version (it drops ?:): ^(|(.+\.)*uic\.edu)\z<br>
<br>
#!/usr/bin/env perl<br>
use strict;<br>
use warnings;<br>
<br>
# match empty, 'something.uic.edu' and 'uic.edu'<br>
print "match\n" if ($ARGV[0] =~ m/^(?:|(?:.+\.)*uic\.edu)\z/i);<br>
<br>
<br>
<br>
I strongly recommended following the realms with this additional Handler <br>
that grounds the rest of the converted requests:<br>
<br>
<Handler ConvertedConvertedFromEAPMSCHAPV2=1><br>
<AuthBy INTERNAL><br>
DefaultResult REJECT<br>
</Handler><br>
</Handler><br>
<br>
This makes sure that realms such as 'example.com' get processed and <br>
rejected.<br>
<br>
<br>
<br>
Related to this: If there are also multiple <Handler TunnelledByPEAP=1, <br>
...> instances, in this case there should be similar catch-all handler:<br>
<br>
<Handler TunnelledByPEAP=1><br>
<AuthBy FILE><br>
EAPType ...<br>
Filename /dev/null<br>
</AuthBy><br>
<Handler><br>
<br>
This makes sure that EAP gets started when username and realm is not <br>
known yet (the first EAP message) but it will never allows <br>
authenticating PEAP tunnelled requests the other Handlers haven't matched.<br>
<br>
<br>
To summarise how handle all converted and tunnelled requests:<br>
<br>
<br>
<Handler ConvertedFromEAPMSCHAPV2=1, Realm=something><br>
# Authenticate something<br>
</Handler><br>
<br>
<Handler ConvertedFromEAPMSCHAPV2=1, Realm=somethingelse><br>
# Authenticate somethingelse<br>
</Handler><br>
<br>
# Unexpected realm: reject<br>
<Handler ConvertedFromEAPMSCHAPV2=1><br>
# No EAP here, can reject with INTERNAL<br>
<AuthBy INTERNAL><br>
DefaultResult REJECT<br>
</Handler><br>
</Handler><br>
<br>
<br>
<br>
<Handler TunnelledByPEAP=1, Realm=something><br>
# Authenticate something<br>
</Handler><br>
<br>
<Handler TunnelledByPEAP=1, Realm=somethingelse><br>
# Authenticate somethingelse<br>
</Handler><br>
<br>
# Initial EAP message with no no EAP identity/username<br>
# known yet, initiate desired inner EAP; or<br>
# If not initial EAP message: it's an unexpected realm: reject<br>
<Handler TunnelledByPEAP=1><br>
<AuthBy FILE><br>
EAPType EAP-MSCHAP-V2<br>
Filename /dev/null<br>
</Handler><br>
</Handler><br>
<br>
<br>
-- <br>
Heikki Vatiainen<br>
OSC, makers of Radiator<br>
Visit radiatorsoftware.com for Radiator AAA server software<br>
_______________________________________________<br>
radiator mailing list<br>
radiator@lists.open.com.au<br>
<a href="https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.open.com.au%2Fmailman%2Flistinfo%2Fradiator&data=04%7C01%7Crullfig%40uic.edu%7C9cfe41c790d74ed4f9d508d9d1e1c936%7Ce202cd477a564baa99e3e3b71a7c77dd%7C0%7C0%7C637771590211444328%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=DI4Dhi5RcK5sJwjn0P%2FsWiEpywSe%2BcQJA2GM7JSMR5U%3D&reserved=0">https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.open.com.au%2Fmailman%2Flistinfo%2Fradiator&data=04%7C01%7Crullfig%40uic.edu%7C9cfe41c790d74ed4f9d508d9d1e1c936%7Ce202cd477a564baa99e3e3b71a7c77dd%7C0%7C0%7C637771590211444328%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=DI4Dhi5RcK5sJwjn0P%2FsWiEpywSe%2BcQJA2GM7JSMR5U%3D&reserved=0</a></div>
</span></font></div>
</body>
</html>