Re: Two factor authentication to both LDAP directory and SecurID

2009-02-27 Thread tnt
So I think what will happen is this: - username/tokencode-password is passed from the Cisco ASA device - this data is passed in cleartext to the script - script splits the username/tokencode and username/password - script proxies the u/tc via RADIUS to SecurID - script uses PAP to pass

Re: Two factor authentication to both LDAP directory and SecurID

2009-02-26 Thread Greg Vickers
Hi Ivan, t...@kalik.net wrote: Yes. There is no problem in composing Cleartext-Password on the fly from users password and the token.It shouldn't be too difficult to create a perl script that does that. Excellent! So the username and tokencode/password is passed from the NAS (ASA5500) to the

Re: Two factor authentication to both LDAP directory and SecurID

2009-02-24 Thread tnt
Scenario: To pilot the SecurID product, we selected VPN access to a part of our network, protected by a Cisco ASA5500 series device. We are in the process of moving away from the MS IAS RADIUS solution to FreeRADIUS. We know that MS IAS cannot do what we want to do. What we want to do: When a

Re: Two factor authentication to both LDAP directory and SecurID

2009-02-24 Thread Greg Vickers
Hi Ivan, t...@kalik.net wrote: Scenario: To pilot the SecurID product, we selected VPN access to a part of our network, protected by a Cisco ASA5500 series device. We are in the process of moving away from the MS IAS RADIUS solution to FreeRADIUS. We know that MS IAS cannot do what we want to

Re: Two factor authentication to both LDAP directory and SecurID

2009-02-24 Thread tnt
Yes. There is no problem in composing Cleartext-Password on the fly from users password and the token.It shouldn't be too difficult to create a perl script that does that. Excellent! So the username and tokencode/password is passed from the NAS (ASA5500) to the FreeRADIUS server and we create

Two factor authentication to both LDAP directory and SecurID

2009-02-23 Thread Greg Vickers
Hi all, Firstly, this relates to a question asked for our project by Amy Hawke: http://lists.freeradius.org/mailman/htdig/freeradius-users/2009-January/msg00617.html Since the above conversation, I've had an email discussion with Alan DeKok and clarified a few things - it seems that what we