<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:10pt"><div>Dear all,</div><div>I was trying to figure out how to provide access to my StrongSWAN installation to users through LDAP authentication.</div><div>I have a Lotus Domino server that provides LDAP services and I managed to configure FreeRadius to talk with Domino.</div><div>The command line utility 'radtest' works fine as it plaintext, but as soon as I try to link StrongSwan using EAP-RADIUS</div><div>from Windows 7 clients, no way.</div><div><br></div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: 'times new roman', 'new york', times, serif; background-color: transparent; font-style: normal; ">If my understanding is correct MSCHAPv2 sends hashed passwords that are incompatible with LDAP so the daemons and</div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: 'times new roman', 'new york', times,
serif; background-color: transparent; font-style: normal; ">servers talk each other but users' passwords don't match.</div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: 'times new roman', 'new york', times, serif; background-color: transparent; font-style: normal; "><br></div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: 'times new roman', 'new york', times, serif; background-color: transparent; font-style: normal; ">My question is: is there any other way to allow Windows 7 users to connect to StrongSWAN while authenticating them in LDAP,</div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: 'times new roman', 'new york', times, serif; background-color: transparent; font-style: normal; ">maybe switching to PEAP or something else?</div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: 'times new roman', 'new york', times, serif; background-color: transparent; font-style: normal;
"><br></div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: 'times new roman', 'new york', times, serif; background-color: transparent; font-style: normal; ">My constraint is that I cannot change the existing password and it would be difficult to implement a second password in LDAP</div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: 'times new roman', 'new york', times, serif; background-color: transparent; font-style: normal; ">(as someone mentioned in this mailing list as well).</div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: 'times new roman', 'new york', times, serif; background-color: transparent; font-style: normal; "><br></div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: 'times new roman', 'new york', times, serif; background-color: transparent; font-style: normal; ">Would it be different if, instead of the Domino LDAP server, I would use a Novell eDirectory, acting as domain
controller?</div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: 'times new roman', 'new york', times, serif; background-color: transparent; font-style: normal; "><br></div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: 'times new roman', 'new york', times, serif; background-color: transparent; font-style: normal; ">Thank you very much for any help you could give me on the subject.</div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: 'times new roman', 'new york', times, serif; background-color: transparent; font-style: normal; "><br></div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: 'times new roman', 'new york', times, serif; background-color: transparent; font-style: normal; ">Best regards,</div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: 'times new roman', 'new york', times, serif; background-color: transparent; font-style: normal; ">Claudio
Morgia</div></div></body></html>