7.4. Configuring a RADIUS server for OTP validation in IdM

Procedure

1. Add a RADIUS proxy:

   $ ipa radiusproxy-add proxy_name --secret secret

   The command prompts you for inserting the required information.

   The configuration of the RADIUS proxy requires the use of a common secret between the client and the server to wrap credentials. Specify this secret in the --secret parameter.

2. Assign a user to the added proxy:

   ipa user-mod radiususer --radius=proxy_name

3. If required, configure the user name to be sent to RADIUS:

   ipa user-mod radiususer --radius-username=radius_user

   As a result, the RADIUS proxy server starts to process the user OTP authentication.

   When the user is ready to be migrated to the IdM native OTP system, you can simply remove the RADIUS proxy assignment for the user.

   注意

   In certain situations, such as running a RADIUS proxy in a slow network, the Identity Management (IdM) Kerberos Distribution Center (KDC) closes the connection before the RADIUS server responds because the connection timed out while waiting for the user to enter the token. You can change the timeout settings of the KDC.

4. Change the value of the timeout parameter in the [otp] section in the /var/kerberos/krb5kdc/kdc.conf file. For example, to set the timeout to 120 seconds:

   [otp]
   DEFAULT = {
     timeout = 120
     ...
   }

5. Restart the krb5kdc service:

   # systemctl restart krb5kdc