Re: 802.1X - ldap AND users file

Alan DeKok via Freeradius-Users <[email protected]> Wed, 1 Apr 2026 12:20:14 -0400

Newsgroups	gmane.comp.freeradius.user
Message-ID	<[email protected]>

On Apr 1, 2026, at 11:22 AM, cedric Delaunay <[email protected]> wrote:
> I'd like to find how to force "accept" for a special user, based on "mods-config/files/authorize" file
> - user is logged-in on device so that is real username is kown only by inner-tunnel
> - user isn't known by ldap (that's why I try with "users" file)
> - user's password may change so that I don't want to check it

  This allegedly works.  It was posted to the list a while back.  I haven't had a chance to test it in detail, or figure out exactly what Windows is doing with it.

authorize {
...
      update {
           &control:SMB-Account-CTRL-TEXT := '[N]'
           &reply:MS-CHAP2-Success = 'password-free'
       }
..

  That allegedly works for MS-CHAP authentication.  I've tried it with PEAP, and got nowhere.

  Alan DeKok.

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

signature.asc (application/pgp-signature, 833 B)