Authentication with Google Workspace using FreeRadius and STunnel
-
Good morning everyone, I implemented a captive portal some time ago. It's based on a Google Workspace authentication mechanism that works very well.
It involves creating an LDAP app on Google Workspace and then downloading the key, certificate, and credentials generated for binding.
Then I configured Stunnel, the native PfSense LDAP module, and the captive portal.
For a variety of reasons, however, I decided to use the PfSense FreeRadius package instead of the native LDAP module.
I followed the steps outlined in multiple guides, but the authentication test in Diagnistic always fails.
I've attached some screenshots of the current FreeRadius configuration.
Where am I going wrong?
Thanks in advance. -
Anything logged when you try to authenticate?
I assume local Radius users are recognized as expected?
-
@stephenw10 said in Authentication with Google Workspace using FreeRadius and STunnel:
Hi,Anything logged when you try to authenticate?
(0) Login incorrect (Failed retrieving values required to evaluate condition): [garottotest] (from client localhost port 0)
I assume local Radius users are recognized as expected?
I don't have any local Radius users. Is this something worth trying?
-
Yes I would test each part of the process individually if you can.
I would also check for states on the ports set when you test. Is it actually trying to connect to Google LDAP?
-
@stephenw10 Local authentication works.
However, I have some doubts about some fields in the LDAP tab:
Identity > should it be just the username or also the domain?
Base DN > is this correct? The client's Google Workspace domain is liceogarotto.it
Filter > is this correct?
Base filter > should it be left blank?
Based on the screenshots I attached, are there other fields that might not be correct?
Thanks -
I can't really comment on the specific LDAP query. There are a lot of possibilities there and it feels like a minefield whenever I have to use it!
But check that Radius is at least sending the query and opening a state.
-
@stephenw10 I definitely think so. I'll send you the complete logs, which also show Stunnel's activity.
Apr 13 16:45:36 radiusd 6710 (7) Login incorrect (Failed retrieving values required to evaluate condition): [garottotest] (from client localhost port 0)
Apr 13 16:45:36 stunnel 78612 LOG6[41]: Session id: A8BAA329F0626407B8FF4528DB1AC44591BB6B72B264CE628710BA2B53B80230
Apr 13 16:45:36 stunnel 78612 LOG6[41]: Session id: 73781DE64B28C6608DACBD56BFA128617B452A4A337EF220DD91BF1DB5EA3EC8
Apr 13 16:45:35 stunnel 78612 LOG6[41]: Session id: CAEB40BFABC9B02A5E679CC6B883D363EA7AD40817AC43A39F13B397842F8D14
Apr 13 16:45:35 stunnel 78612 LOG6[41]: Peer temporary key: X25519, 253 bits
Apr 13 16:45:35 stunnel 78612 LOG6[41]: TLSv1.3 ciphersuite: TLS_AES_256_GCM_SHA384 (256-bit encryption)
Apr 13 16:45:35 stunnel 78612 LOG6[41]: TLS connected: previous session reused
Apr 13 16:45:35 stunnel 78612 LOG6[41]: OCSP: Certificate chain verification disabled
Apr 13 16:45:35 stunnel 78612 LOG6[41]: Peer certificate not required
Apr 13 16:45:35 stunnel 78612 LOG6[41]: SNI: sending servername: ldap.google.com
Apr 13 16:45:35 stunnel 78612 LOG5[41]: Service [GoogleWorkspace] connected remote server from 192.168.0.55:1828
Apr 13 16:45:35 stunnel 78612 LOG5[41]: s_connect: connected 216.239.32.58:636
Apr 13 16:45:35 stunnel 78612 LOG6[41]: s_connect: connecting 216.239.32.58:636
Apr 13 16:45:35 stunnel 78612 LOG6[41]: failover: priority, starting at entry #0
Apr 13 16:45:35 stunnel 78612 LOG5[41]: Service [GoogleWorkspace] accepted connection from 127.0.0.1:59046
Apr 13 16:45:34 stunnel 78612 LOG6[40]: Session id: CAEB40BFABC9B02A5E679CC6B883D363EA7AD40817AC43A39F13B397842F8D14
Apr 13 16:45:34 stunnel 78612 LOG6[40]: Session id: 599E49101A06DBCB47C5186AD416ED5AC692F81EE2AA2F1B6745ABC19F23AB18
Apr 13 16:45:34 stunnel 78612 LOG6[40]: Session id: A5C9C215BDB89CCF65CC35BA0233B4B85810EA321F3DC3FBF2C4D9D3B3DFC4BF
Apr 13 16:45:34 stunnel 78612 LOG6[40]: Peer temporary key: X25519, 253 bits
Apr 13 16:45:34 stunnel 78612 LOG6[40]: TLSv1.3 ciphersuite: TLS_AES_256_GCM_SHA384 (256-bit encryption)
Apr 13 16:45:34 stunnel 78612 LOG6[40]: TLS connected: previous session reused
Apr 13 16:45:34 stunnel 78612 LOG6[40]: OCSP: Certificate chain verification disabled
Apr 13 16:45:34 stunnel 78612 LOG6[40]: Peer certificate not required
Apr 13 16:45:34 stunnel 78612 LOG6[40]: SNI: sending servername: ldap.google.com
Apr 13 16:45:34 stunnel 78612 LOG5[40]: Service [GoogleWorkspace] connected remote server from 192.168.0.55:28209
Apr 13 16:45:34 stunnel 78612 LOG5[40]: s_connect: connected 216.239.32.58:636
Apr 13 16:45:34 stunnel 78612 LOG6[40]: s_connect: connecting 216.239.32.58:636
Apr 13 16:45:34 stunnel 78612 LOG6[40]: failover: priority, starting at entry #0
Apr 13 16:45:34 stunnel 78612 LOG5[40]: Service [GoogleWorkspace] accepted connection from 127.0.0.1:62544 -
Yup OK that looks pretty conclusive.
Can you get any sort of logs from the Google side?
Privacy Policy · Cookie Policy