Doing 2FA via Freeradius with our own 2FA app - freeradius

Question

Some DATA firts:
Freeradius v3.0.17
Active Directory as LDAP
OTP app developed by ourself
What We want to achieve is 2FA via Freeradius. We are using authentication with ntlm_auth against an MS AD and on the other hand We have our own OTP script (This is working in another solution).
At first we have a policy that splits the USER and Token, like this --> username:OTP. This is working.
This procces is called at the top of authorize section on Default site
on policy.d/pol_usernamemultiotp.authorize:
pol_usernamemultiotp.authorize {
if ( &User-Name =~ /^(.*):([0-9]{6})$/) {
update request {
Stripped-User-Name := "%{1}"
User-OTP := "%{2}"
}
}
}
The ntlm_auth is working properly.
When we add the next code in authorize section on Default, the authentication jumps to Auth-Type := LDAP and wont do throught ntlm_auth.
update control {
Auth-Type := `/bin/bash /etc/freeradius/3.0/otpIB.sh '%{Stripped-User-Name}' '%{User-OTP}' '%{Client-IP-Address}'`
}
(this script returns "Accept" or "Reject" depending if the OTP is correct.)
We also try to put this update control on Post-Auth section on Default. BUT, here is the problem. Let us show you with de Freeradius -X logs
(0) mschap: Program returned code (0) and output 'NT_KEY: C1964544A5B93877F0D3FE7D9E5791D0'
(0) mschap: Adding MS-CHAPv2 MPPE keys
(0) [mschap] = ok
(0) } # authenticate = ok
(0) # Executing section post-auth from file /etc/freeradius/3.0/sites-enabled/default
(0) post-auth {
(0) update control {
(0) Executing: /bin/bash /etc/freeradius/3.0/otpIB.sh '%{Stripped-User-Name}' '%{User-OTP}' '%{Client-IP-Address}':
(0) EXPAND %{Stripped-User-Name}
(0) --> fdelfranco
(0) EXPAND %{User-OTP}
(0) --> 770355
(0) EXPAND %{Client-IP-Address}
(0) --> 10.40.9.3
(0) Program returned code (0) and output 'Reject'
(0) Auth-Type := Reject
(0) } # update control = noop
(0) update {
(0) No attributes updated
(0) } # update = noop
(0) policy remove_reply_message_if_eap {
(0) if (&reply:EAP-Message && &reply:Reply-Message) {
(0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE
(0) else {
(0) [noop] = noop
(0) } # else = noop
(0) } # policy remove_reply_message_if_eap = noop
(0) } # post-auth = noop
(0) Sent Access-Accept Id 195 from 10.40.9.99:1812 to 10.40.9.3:21481 length 0
(0) MS-CHAP2-Success 0xf9533d36433832463034413330323043344533314246333736383533364234324641453142383843383145
(0) MS-MPPE-Recv-Key = 0x66e467b713b84475fa5ed19d93207ef3
(0) MS-MPPE-Send-Key = 0x75f6cbee712186fe6ebeca98ea9ab063
(0) MS-MPPE-Encryption-Policy = Encryption-Allowed
(0) MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed
(0) Finished request
NTLM_AUTH works perfectly and gives and Access-Accept, ignoring completely the script and the Auth-Type := Reject that returns!
Why is the Radius ignoring the state of "reject" from the script and authorizinging the user ??
Some suggestions?
Edit:
Today We managed to get this thing working without a challenge, but working. We create like some kind of new Auth Type, and we put the policy there so, When we make the Authorize parte, it calls this pseudo Auth Type in the Authenticate section of the Defaul file and then, after thar it make a call for our own policy, where We have pointed our own shell script that makes the one-time-password validation properly.
It works great with Cisco VPN client, Forti Client and with Mac OS native client for IPSEC.

Answer 1

Auth-Type must to be set on reply, not control.