Active Directory / Freeradius / ntlm_auth / mail attribute

active-directoryfreeradiusntlmradius

I am currently configuring a linux server with Freeradius to have our clients authenticate against our Active Directory for our WiFi-network.

The goal is to have our users use the e-mail address that is present the Active Directory as the 'mail' attribute and their domain password to authenticate to the WiFi network.

The format of our AD naming is as follows

name: Joe Jonssen
username: foo\jjon1
UPN: jjon1@foo.bar.lan
mail address: j.jonssen@company.com

I currently have ntlm_auth working and am able to login with jjon1 and the password. But we want to login with j.jonssen@company.com and the password.

Is there any way to achieve this, I am not bound to Freeradius as Radius server. We need to use our mail address as username for the WiFi network because we are thinking about joining an initiative like Eduroam and logging in with mail address is required.

Best Answer

You can find out the Username/sAMAccountName by starting a LDAP query to the AD and then performing the NTLM-Authentication.

A very basic bash script mail_to_username (without any input filter) would look like this:

#!/bin/bash

MAIL=$1
NTDOMAIN=$2
CHALLENGE=$3
NTRESPONSE=$4

HOST="ldap://ip-adress"
BASE_DN="OU=Users,DC=example,DC=de"
BIND_DN="LDAP-freeradius@example.de"
PASSWORD="x"
FILTER="mail=$MAIL"

sAMAccountName=`ldapsearch -LLL -x -D "$BIND_DN" -w "$PASSWORD" -b "$BASE_DN" -H "$HOST" "$FILTER" sAMAccountName | grep sAMAccountName | awk '{print $2}'`

/usr/bin/ntlm_auth --request-nt-key --username=$sAMAccountName --domain=$NTDOMAIN --challenge=$CHALLENGE --nt-response=$NTRESPONSE

inside the mschap-module you call the bash-script instead of calling directly ntlm_auth:

ntlm_auth = "/usr/bin/mail_to_username %{mschap:User-Name:-None} %{%{mschap:NT-Domain}:-EXAMPLE} %{mschap:Challenge:-00} %{mschap:NT-Response:-00}"
Related Topic