PrivacyIdea SSL-VPN Radius Integration

[Nikhil_Jaisawal]

Hello All,

I have recently joined the Infrastructure department of an organization and asked to deploy an open-source 2FA solution for SSL-VPN login. We are using a Fortigate firewall for VPN and AD for end-user authentication.

I have installed PrivacyIdea in centOS and i’m able synchronize the users from AD.

Can you please help me with below queries-

1. What will be architecture of Radius, AD,firewall(VPN) and PrivacyIdea?
2. Do we need additional plugin for Radius?
3. Is it an open source or a commercial solutions

Thanks!

[henry]

1. Clarify your question.
2. Just the Radius plugin in PI.
3. Open source. If you need support, you’ll pay.

[cornelinux]

@Nikhil_Jaisawal

1. Is it an open source or a commercial solutions

Hello @Nikhil_Jaisawal,

welcome to the privacyIDEA community.
Thank you for your very good question. It helped me to understand what I need to clarify.
Please read this:

Is privacyIDEA an open source or a commercial solution

Hi all, a user asked if privacyIDEA was an open source or a commercial solution. That is a very good question, because is shows one thing, that in my opinion happens often in this forum. Why is the question being it A or B? privacyIDEA is an open source solution. It is definitively an enterprise solution. And sometimes it is a commercial solution. If someone asks if it is open source or comercial, this indicates that you think open source and commercial do actually mutually exclude each other…

[wwalker]

I actually just finished implementing this with a Fortigate. You’ll use the privacyidea-freeradius plugin to get the Fortigate authenticating against PrivacyIDEA.

[cornelinux]

Hi @Nikhil_Jaisawal

I hope you read my lengthy post and now have a better understanding of the privacyIDEA universe.

Here you find a talk, which I held in 2018 at the linux fest north west. I explain the integration of privacyIDEA.

• You connect privacyIDEA to your AD to read the users. Read and understand resolvers: https://privacyidea.readthedocs.io/en/latest/configuration/useridresolvers.html

• Then VPN can be connected in different ways. Some VPNs (like Netscaler) allow two authentication steps. You would configure LDAP and RADIUS in the Netscaler and connect via RADIUS to privacyIDEA using the 2nd factor. Or your VPN would only allow one authenitcation step, that you would connect only via RADIUS to privacyIDEA to authenticate via RADIUS. As @henry and @wwalker already pointed out, you need the privacyIDEA RADIUS plugin for FreeRADIUS. Read and understand https://privacyidea.readthedocs.io/en/latest/installation/ubuntu.html#freeradius and https://privacyidea.readthedocs.io/en/latest/application_plugins/rlm_perl.html#rlm-perl