I have a working freeradius 3.0 connected to active directory and an aruba access point.
users are able to login using cn@domain. e.g. [email protected]. I’m now trying to also make it possible to allow userPrincipalName for login. e.g. [email protected] (cn cannot be derived from upn without doing an ldap lookup).

in global and inner-tunnel I have ldap enabled under authorize and I’m correctly able to identify the user with this ldap-filter (I’m calling suffix before ldap):
filter = "(|(cn=%{Stripped-User-Name})(userPrincipalName=%{User-Name}))"

I’ve also checked that I’m able to hardcode a variable in gobal like this: testvar = tesuse.
And then in the authorize section in global and inner-loop update Stripped-User-Name like this:
update request {Stripped-User-Name = "${testvar}"} and then call mschap. This will work if I log in using “[email protected]” (whose cn is “tesuse”).

But how to get the actual user’s cn from the ldap module and set Stripped-User-Name to that? I haven’t been able to figure out if this is possible and if so what the correct syntax is. The reason I need this is that mschap authentication won’t work with upn (or at least it doesn’t seem to work by default).

The reason I want to allow users to use upn, is because its the syntax they use to log in to most systems and the cn@domain syntax is just causing a lot of unnecessary confusion.