IBM Security Verify

 View Only
Expand all | Collapse all

IBM Security Verify Gateway for RADIUS - RADIUS capabilities

  • 1.  IBM Security Verify Gateway for RADIUS - RADIUS capabilities

    Posted Mon March 01, 2021 11:34 AM
    I'm trying to figure out whether the IBM Security Verify Gateway for RADIUS supports:

    - TLS support for NAS-Radius Server communications (tunneling of Radius port 1812 UDP protocol inside TLS - certificate-based)
    - LDAP integration, and if yes, LDAP-S (again, TLS)
    - Policy-based OTP, as follows
    > Policy does LDAP look-up
    > Returns group membership & continue
    > second policy checks attribnute (group membership)
    > If member of group --> return accept
    -> if not member of group --> send OTP prompt + upstream authN request (e.g. to myTenant.ice.ibmcloud.com)

    I've downloaded the CIV GW for RAdius. The sample IbmRadiusConfig.json file is a bit minimal
    I've checked Configuring the IBM Security Verify Gateway for RADIUS server, but not much more to be found

    So in short, the CIV GW for Radius is a small RADIUS server. Would be good to see what Radius-related RFC's are supported, and to have insight into Policy capabilities. My reference is FreeRadius, which support all of the above.

    Many thanks
    Johan

    ------------------------------
    Johan Genbrugge
    ------------------------------


  • 2.  RE: IBM Security Verify Gateway for RADIUS - RADIUS capabilities
    Best Answer

    Posted Wed March 03, 2021 06:41 AM
    Johan,

    Here are some responses to your questions:

    > TLS support for NAS-Radius Server communications (tunneling of Radius port 1812 UDP protocol inside TLS - certificate-based)
    We don't support this.  Only a basic form of RFC2865 using PAP (no CHAP).
    Is this referring to RFC 6614?

    > LDAP integration, and if yes, LDAP-S (again, TLS)
    We support integration against AD that local system is connected to. This is using windows APIs - not LDAP.
    We support integration with LDAP via LDAP-passthrough.  The communication goes to Verify (in cloud) and then back to on-premises directory via the "Verify Bridge for Authentication".  The communication with Verify is TLS.  The bridge does support LDAPS connection.

    > Policy-based OTP, as follows
    > Policy does LDAP look-up
    > Returns group membership & continue
    > second policy checks attribnute (group membership)
    > If member of group --> return accept
    > if not member of group --> send OTP prompt + upstream authN request (e.g. to myTenant.ice.ibmcloud.com)
    We do not support this use case today.  It is only possible to have policies triggered before authentication or after *all* authentication.
    There is no option to have the policy execute between password and 2FA (to allow a bypass of 2FA for example).

    I understand the value of both of these items.  If you have a need for these, please consider opening an RFE.
    https://ibmsecurity-ci-community.ideas.aha.io/

    Jon.


    ------------------------------
    Jon Harry
    Consulting IT Security Specialist
    IBM
    ------------------------------

    Original Message