Freeradius and Google LDAP

Question

I have configured the Freeradius on an Ubuntu server based on the instructions provided in https://support.google.com/a/answer/9048434?hl=en&ref_topic=9173976.

From the Ubuntu server itself, I have been able to authenticate my Google account using 'radtest'. However, when I try to authenticate from an AP which I registered as the client for the Freeradius server (in clients.conf), I couldn't get authenticated. Is this something to do with CA certificates?

Are there any manuals or guides that I can use to configure Freeradius with Google LDAP? Thanks.

Answer 1

did you get any error messages back? This will give some indication of what the problem is. Bad ID or password or something with the Search or ACL access.

Answer 2

radtest works because it sends a cleartext password to the RADIUS server, which can then present it to Google LDAP to try and bind. Google LDAP won't let you get a copy of the password, so you're very limited in what methods you can use to authenticate.

For wireless you need to use an EAP method which presents the password in the clear to the RADIUS server, the most likely being EAP-TTLS/PAP. Common EAP methods such as PEAP/EAP-MSCHAPv2 or EAP-TTLS/MSCHAPv2 won't work, as the RADIUS server doesn't have a copy of the password to try and bind with.

You also need to make sure that you do the LDAP authentication stages in the inner-tunnel virtual server, not in the outer (the password from EAP-TTLS/PAP is only available in the inner virtual server after it has been decrypted from the TLS tunnel). It's not clear from the question where you are doing it. If you configured LDAP in the default virtual server then plain radtest will work, but no EAP methods will.

Answer 3

Contrary to what @matthew-newton says here, getting an EAP method working is possible.

Once you have a functioning radtest against the Google service, double-check what method the supplicant is sending by reading the debug output ( #freeradius -X ) of a real connection request. You'll see that after the initial response from Google, there is no eap_peap/MSCHAPv2 password configured.

If you get that far, put to work what is demonstrated in this pre-packaged dockerized solution. If you look into /configs, you'll find the the site and mod files (default, ldap, eap, and inner-tunnel) already configured for use with Google LDAP. I don't recommend dropping them in. You should read them as you go and make the changes to your own config only as necessary.