How VPNs authenticate a user using RADIUS

Question

I have just had a lecture on VPNs and RADIUS and have a question with regards to authentication. I am aware of protocols such as EAP and PEAP and was wondering how these protocols work alongside RADIUS, if at all.

Ultimately as the question title suggests, if a user would like to connect to a network device on an internal network using SSL VPN how would they authenticate?

My initial thoughts were that the VPN server defines an authentication protocol such as EAP, the user then provides the correct credentials in accordance with the protocol and the VPN server acting as a RADIUS client forwards the data to the RADIUS server using the RADIUS protocol. The RADIUS server looks up the given credentials and if correct issues an acceptance message. The user is then authenticated and the VPN server can allow access to the network resources.

I would be grateful if someone could give me some guidance. I appteciate that my initial thoughts may be completely incorrect.

Thanks.

Answer 1

Microsoft says it well:

Architecturally, an EAP infrastructure consists of the following:

• EAP peer Computer that is attempting to access a network, also known as an access client. EAP authenticator An access point or network access server (NAS) that is requiring EAP authentication prior to granting access to a network.
• Authentication server A server computer that negotiates the use of a specific EAP method with an EAP peer, validates the EAP peer's credentials, and authorizes access to the network.
• Typically, the authentication server is a Remote Authentication Dial-In User Service (RADIUS) server.

EAP is extensible through EAP methods that plug-in at both the EAP peer and authenticating server ends of a connection. To add support for a new EAP method, you install an EAP method library file on both the EAP peer and the authenticating server. This capability to extend EAP provides vendors with the opportunity to create new authentication schemes. EAP provides the highest flexibility to allow for more secure authentication methods.

The EAP peer and the EAP authenticator send EAP messages using a supplicant-a software component that uses EAP to authenticate network access-and a data link layer transport protocol such as PPP or IEEE 802.1X. The EAP authenticator and the authentication server send EAP messages using RADIUS. The end result is that EAP messages are exchanged between the EAP components on the EAP peer and the authentication server. The following figure shows EAP infrastructure and information flow.