Project

General

Profile

User story #15739

Radius auth with Challenge-Response

Added by François ARMAND 11 months ago. Updated 3 months ago.

Status:
New
Priority:
N/A
Assignee:
-
Target version:
Pull Request:
Suggestion strength:
User visibility:
Effort required:

Description

We would like to support radius auth with a yubikey.

#1

Updated by Janos Mattyasovszky 11 months ago

  • Subject changed from Radius auth with yubikey to Radius auth with Challenge-Response
#2

Updated by Janos Mattyasovszky 11 months ago

Some issues with the RADIUS Authentication backend:

- Currently the radius plugin uses some strange code for the Radius-Challenge part of the authentication process, and mentions SecurID, which is the RSA Token's authentication name, but RADIUS is not limited to RSA SecurID, but can be used to ask any kind of Questions the User has to provide a reaction to (hence challenge-response).

The first recommentadion is to get rid of mentioning "SecurID" from the code and if possible, make the first "Password" Prompt configurable, as the first secret could be anything, like a passphrase or a PIN, depending on what the first authentication step is.

- Most of the RADIUS Servers determine what authentication policy to use by the Client IP and/or the NAS-Identifier sent by the Client. This can allow to provide different auth methods by different RADIUS Clients originating from the same IP (even if the shared secret must be configured per originating IP of the Client).

The second recommendation is to provide a way (possibly via config file) to provide an optional value that will be sent as the "NAS-Identifier" attribute in the request.

Ref: https://tools.ietf.org/html/rfc2865#page-52

#3

Updated by Vincent MEMBRÉ 8 months ago

  • Target version changed from 5.0-1.3 to 5.0-1.4
#4

Updated by François ARMAND 3 months ago

There is also other problem related to accepted access/response:

the radius plugin
has a cache for creds
anyway to disable that as it breaks OTP flows with Radius

It may be linked to:

- https://github.com/coova/jradius/issues/6
How to deal with the Access-challenge response?

- Or again: https://github.com/dodok1/cas/commit/29012f53bffb59cd25a83b27f0a14493efa64106

Also available in: Atom PDF