# SSO Active Directory via RADIUS using PAP

**URL:** <https://forum.pritunl.com/t/sso-active-directory-via-radius-using-pap/3747>\
**Category:** Pritunl VPN\
**Tags:** pritunl\
**Created:** [March 6, 2026, 3:04pm UTC](https://forum.pritunl.com/t/sso-active-directory-via-radius-using-pap/3747 "2026-03-06T15:04:53Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![giovanni-bellini-arg](https://forum.pritunl.com/user_avatar/forum.pritunl.com/giovanni-bellini-arg/32/1463_2.png) [@giovanni-bellini-arg](https://forum.pritunl.com/u/giovanni-bellini-arg)\
**Post date:** [March 6, 2026, 3:04pm UTC](https://forum.pritunl.com/t/sso-active-directory-via-radius-using-pap/3747/1 "2026-03-06T15:04:53Z")

</div>

As of today the only method supported for authentication by the Active Directory SSO is PAP/SPAP which are unencrypted, meaning the password is sent in clear from the pritunl server to the RADIUS server.

my proposal is to implement the more secure EAP MS-CHAPv2 auth method.

---

<div class="post-metadata">

**Author:** ![zach](https://forum.pritunl.com/user_avatar/forum.pritunl.com/zach/32/1105_2.png) [@zach](https://forum.pritunl.com/u/zach)\
**Post date:** [March 8, 2026, 1:22am UTC](https://forum.pritunl.com/t/sso-active-directory-via-radius-using-pap/3747/2 "2026-03-08T01:22:12Z")

</div>

There isn’t any good support in Python for RADIUS with EAP MS-CHAPv2. Most Active Directory installations have transitioned to Microsoft Entra which is supported in Pritunl. It could be done with the [**plugin system**](https://docs.pritunl.com/kb/vpn/system/plugins) by adding the file `/var/lib/pritunl/plugins/radius.py`.

```python
from pritunl import settings
from pritunl import logger

# [SYNCHRONOUS] Called on user login must return True or False and an
# organization name that the user will be added to. The organization name must
# be included. Also called on each user connection. This plugin is used to
# support user logins with credentials from other systems. The user_name and
# password must be verified in the plugin, no other authentication will be
# checked.
def user_authenticate(host_id, host_name, user_name, password, remote_ip,
        **kwargs):
    logger.info('RADIUS plugin authenticate', 'plugin',
        host_id=host_id,
        host_name=host_name,
        user_name=user_name,
        remote_ip=remote_ip,
        sso=settings.app.sso,
        sso_radius_host=settings.app.sso_radius_host,
        sso_radius_secret=settings.app.sso_radius_secret,
        sso_radius_timeout=settings.app.sso_radius_timeout,
        sso_radius_prefix=settings.app.sso_radius_prefix,
    )

    if AUTH_OK:
        return True, 'organization_name', ['group', 'names']
    else:
        return False, None, None

```

---

<div class="post-metadata">

**Author:** ![giovanni-bellini-arg](https://forum.pritunl.com/user_avatar/forum.pritunl.com/giovanni-bellini-arg/32/1463_2.png) [@giovanni-bellini-arg](https://forum.pritunl.com/u/giovanni-bellini-arg)\
**Post date:** [March 9, 2026, 1:44pm UTC](https://forum.pritunl.com/t/sso-active-directory-via-radius-using-pap/3747/3 "2026-03-09T13:44:41Z")

</div>

Thanks for the answer and the example,  
though the approach you suggested dosen’t permit the usage of EAP-TSL which makes use of certificates instead of a password.

is there a way to implement it via plugins?

---

<div class="post-metadata">

**Author:** ![zach](https://forum.pritunl.com/user_avatar/forum.pritunl.com/zach/32/1105_2.png) [@zach](https://forum.pritunl.com/u/zach)\
**Post date:** [March 10, 2026, 2:27pm UTC](https://forum.pritunl.com/t/sso-active-directory-via-radius-using-pap/3747/4 "2026-03-10T14:27:18Z")

</div>

There doesn’t appear to be any Python library for that method of authentication. If you can find code that will do it, it can be added to a plugin.

---

<div class="post-metadata">

**Author:** ![giovanni-bellini-arg](https://forum.pritunl.com/user_avatar/forum.pritunl.com/giovanni-bellini-arg/32/1463_2.png) [@giovanni-bellini-arg](https://forum.pritunl.com/u/giovanni-bellini-arg)\
**Post date:** [March 11, 2026, 9:07am UTC](https://forum.pritunl.com/t/sso-active-directory-via-radius-using-pap/3747/5 "2026-03-11T09:07:51Z")

</div>

what i mean is

via pritunl plugin i don’t see any way to implement the tls handshake needed for the EAP-TLS between the RADIUS server and the client.

i would like to provide the certificate needed for the handshake to the client and then use pritunl to make the auth.

apart from the implementation of the protocol in python my questions are

1. can i pass the certs from the client to the pritunl server
  1. if yes how do i use them in the plugins, i don’t see any arguments for that
  2. if not, is there an alternative way to implement the certificate exchange needed for the authentication?

---

<div class="post-metadata">

**Author:** ![zach](https://forum.pritunl.com/user_avatar/forum.pritunl.com/zach/32/1105_2.png) [@zach](https://forum.pritunl.com/u/zach)\
**Post date:** [March 11, 2026, 3:44pm UTC](https://forum.pritunl.com/t/sso-active-directory-via-radius-using-pap/3747/6 "2026-03-11T15:44:59Z")

</div>

I don’t think that would be possible.