User story #15739
Radius auth with Challenge-Response
We would like to support radius auth with a yubikey.
Updated by Janos Mattyasovszky 11 months ago
Some issues with the RADIUS Authentication backend:
- Currently the radius plugin uses some strange code for the
Radius-Challenge part of the authentication process, and mentions SecurID, which is the RSA Token's authentication name, but RADIUS is not limited to RSA SecurID, but can be used to ask any kind of Questions the User has to provide a reaction to (hence challenge-response).
The first recommentadion is to get rid of mentioning "SecurID" from the code and if possible, make the first "Password" Prompt configurable, as the first secret could be anything, like a passphrase or a PIN, depending on what the first authentication step is.
- Most of the RADIUS Servers determine what authentication policy to use by the Client IP and/or the NAS-Identifier sent by the Client. This can allow to provide different auth methods by different RADIUS Clients originating from the same IP (even if the shared secret must be configured per originating IP of the Client).
The second recommendation is to provide a way (possibly via config file) to provide an optional value that will be sent as the "NAS-Identifier" attribute in the request.
Updated by François ARMAND 3 months ago
There is also other problem related to accepted access/response:
the radius plugin has a cache for creds anyway to disable that as it breaks OTP flows with Radius
It may be linked to:
How to deal with the Access-challenge response?