RADIUS@NPS authentication via python script using pyrad

Apokrif

I spent quite some time trying to make OpenVPN work with RADIUS@NPS via python script using pyrad.
The difficult part was to figure out right config syntax, the only one worked below:
auth-user-pass-verify "C:/Python27/python.exe user-auth.py" via-env
The most surprising thing was: OpenVPN cannot run python (or vbs) script without crouches! :shock:

user-auth.py

#!/usr/bin/python

import os
import sys
import socket
import pyrad.packet
from pyrad.client import Client
from pyrad.dictionary import Dictionary

srv=Client(server="server_ip", secret="some_s3cret", dict=Dictionary("dictionary"))

req=srv.CreateAuthPacket(code=pyrad.packet.AccessRequest, User_Name=os.environ.get('username'))
req["User-Password"]=req.PwCrypt(os.environ.get('password'))

try:
	reply=srv.SendPacket(req)
except pyrad.client.Timeout:
	print "RADIUS server does not reply"
	sys.exit(1)
except socket.error, error:
	print "Network error: " + error[1]
	sys.exit(1)

if reply.code==pyrad.packet.AccessAccept:
	print "access accepted"
	sys.exit(0)
else:
	print "access denied"
	sys.exit(1)

The :idea: was stolen here

Traffic

Apokrif wroteThe most surprising thing was: OpenVPN cannot run python (or vbs) script without crouches! :shock:

(by crouches .. i presume you mean crashes )

Why would openvpn be able to natively run a Python or VBS script ?
Do you want openvpn to come with Python and Windows script host compiled in ?

FYI this:

Apokrif wroteauth-user-pass-verify "C:/Python27/python.exe user-auth.py" via-env

could also be configured like so:

auth-user-pass-verify "C:\\Python27\\python.exe user-auth.py" via-env

Apokrif

Traffic wroteFYI this:
Apokrif wroteauth-user-pass-verify "C:/Python27/python.exe user-auth.py" via-env
could also be configured like so:
auth-user-pass-verify "C:\\Python27\\python.exe user-auth.py" via-env

Nope, OpenVPN returns error smth. like: File "C:\Python27\python.exe user-auth.py" doesn’t exist.

Traffic wroteWhy would openvpn be able to natively run a Python or VBS script?
Do you want openvpn to come with Python and Windows script host compiled in?

I've never said that. I meat, it cannot find python.exe neither via path, because it's reduced to
PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
That’s why we need "C:\Python27\python.exe"

And it ignores file association either, smth. like:
>assoc .py
.py=Python.File
>ftype Python.File
Python.File="C:\Python27\python.exe" "%1" %*
which is funny, because in sample config files line
--auth-user-pass-verify script method
shows script parameter as absolute or relative script path only, without "python prefix".
AFAIK, it’ll work for Unix/Linux only, Windows requires very special syntax. That’s why I wrote:

Apokrif wroteThe most surprising thing was: OpenVPN cannot run python (or vbs) script without crouches! :shock:

Another workaround is to create user-auth.cmd

C:\Python27\python.exe user-auth.py
exit %errorlevel%

and use
auth-user-pass-verify user-auth.cmd via-env

Same is true for vbs, php, etc. script, you can find auth-user-pass-verify samples in this forum branch.

Traffic

Apokrif wroteFile "C:\Python27\python.exe user-auth.py" doesn’t exist

Note the escape character for the folder marker .. " \\" not " \"

Apokrif

Traffic wrote
Apokrif wroteFile "C:\Python27\python.exe user-auth.py" doesn’t exist
Note the escape character for the folder marker .. " \\" not " \"

In case it’s not clear still, below are errors for wrong parameter settings:

auth-user-pass-verify "C:\\Python27\\python.exe user-auth.py" via-env
Options error: --auth-user-pass-verify script fails with 'C:\Python27\python.exe user-auth.py': No such file or directory
Options error: Please correct this error.
Use --help for more information.

auth-user-pass-verify "C:\Python27\python.exe user-auth.py" via-env
Options warning: Bad backslash ('\') usage in server.ovpn:313: remember that backslashes are treated as shell-escapes and if you need to pass backslash characters as part of a Windows filename, you should use double backslashes such as "c:\\openvpn\\static.key"
Use --help for more information.