<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:st1="urn:schemas-microsoft-com:office:smarttags" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<meta name=ProgId content=Word.Document>
<meta name=Generator content="Microsoft Word 10">
<meta name=Originator content="Microsoft Word 10">
<link rel=File-List href="cid:filelist.xml@01C671FF.779795E0">
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="place"/>
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="PostalCode"/>
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="State"/>
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="City"/>
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="Street"/>
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="address"/>
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="PersonName"/>
<!--[if gte mso 9]><xml>
<o:OfficeDocumentSettings>
<o:DoNotRelyOnCSS/>
</o:OfficeDocumentSettings>
</xml><![endif]--><!--[if gte mso 9]><xml>
<w:WordDocument>
<w:SpellingState>Clean</w:SpellingState>
<w:GrammarState>Clean</w:GrammarState>
<w:DocumentKind>DocumentEmail</w:DocumentKind>
<w:EnvelopeVis/>
<w:Compatibility>
<w:BreakWrappedTables/>
<w:SnapToGridInCell/>
<w:ApplyBreakingRules/>
<w:WrapTextWithPunct/>
<w:UseAsianBreakRules/>
<w:UseFELayout/>
</w:Compatibility>
<w:BrowserLevel>MicrosoftInternetExplorer4</w:BrowserLevel>
</w:WordDocument>
</xml><![endif]--><!--[if !mso]>
<style>
st1\:*{behavior:url(#default#ieooui) }
</style>
<![endif]-->
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;
mso-font-charset:2;
mso-generic-font-family:decorative;
mso-font-pitch:variable;
mso-font-signature:0 268435456 0 0 -2147483648 0;}
@font-face
{font-family:"MS Mincho";
panose-1:2 2 6 9 4 2 5 8 3 4;
mso-font-alt:"\,l\,r \\?fc";
mso-font-charset:128;
mso-generic-font-family:roman;
mso-font-pitch:variable;
mso-font-signature:-1610612033 1757936891 16 0 131231 0;}
@font-face
{font-family:"\@MS Mincho";
panose-1:0 0 0 0 0 0 0 0 0 0;
mso-font-charset:128;
mso-generic-font-family:roman;
mso-font-format:other;
mso-font-pitch:variable;
mso-font-signature:1 134676480 16 0 131072 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{mso-style-parent:"";
margin:0in;
margin-bottom:.0001pt;
mso-pagination:widow-orphan;
font-size:12.0pt;
font-family:"Times New Roman";
mso-fareast-font-family:"MS Mincho";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;
text-underline:single;}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline;
text-underline:single;}
span.EmailStyle17
{mso-style-type:personal-compose;
mso-style-noshow:yes;
mso-ansi-font-size:10.0pt;
mso-bidi-font-size:10.0pt;
font-family:Arial;
mso-ascii-font-family:Arial;
mso-hansi-font-family:Arial;
mso-bidi-font-family:Arial;
color:windowtext;}
span.SpellE
{mso-style-name:"";
mso-spl-e:yes;}
span.GramE
{mso-style-name:"";
mso-gram-e:yes;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.25in 1.0in 1.25in;
mso-header-margin:.5in;
mso-footer-margin:.5in;
mso-paper-source:0;}
div.Section1
{page:Section1;}
-->
</style>
<!--[if gte mso 10]>
<style>
/* Style Definitions */
table.MsoNormalTable
{mso-style-name:"Table Normal";
mso-tstyle-rowband-size:0;
mso-tstyle-colband-size:0;
mso-style-noshow:yes;
mso-style-parent:"";
mso-padding-alt:0in 5.4pt 0in 5.4pt;
mso-para-margin:0in;
mso-para-margin-bottom:.0001pt;
mso-pagination:widow-orphan;
font-size:10.0pt;
font-family:"Times New Roman";}
</style>
<![endif]-->
</head>
<body lang=EN-US link=blue vlink=purple style='tab-interval:.5in'>
<div class=Section1>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Hello mailing list!<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>I have tried to search the archive and the web for the
answer to my question but I am unable to find the answer…..<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>I’m sure someone here has run into this before.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>I am attempting to setup the good old <span class=SpellE>freeradius</span>
+ active directory + access point to get <span class=SpellE>peap</span> going scenario.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>I have <span class=SpellE>freeradius</span> setup fine to
use <span class=SpellE>ldap</span> to auth the user, and it works.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>I am attempting to setup finer access control (well really
simple) to check if the user is a member of a group before allowing access.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Here are some <span class=SpellE>configs</span>:<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><span class=SpellE><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>radiusd.conf</span></font></span><font
size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'><o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><span style='mso-spacerun:yes'> </span><span
class=SpellE><span class=GramE>ldap</span></span> {<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><span style='mso-spacerun:yes'> </span><o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><span style='mso-spacerun:yes'> </span><span
class=GramE>server</span> = "domaincontroller.my.domain.com"<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><span style='mso-spacerun:yes'> </span><span
class=GramE>identity</span> = "<span class=SpellE>adreader</span>"<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><span style='mso-spacerun:yes'> </span><span
class=GramE>password</span> = "test1234"<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><span style='mso-spacerun:yes'> </span><span
class=SpellE>basedn</span> = "<span class=SpellE>cn</span>=<span
class=SpellE>users,dc</span>=<span class=SpellE>my,dc</span>=<span
class=SpellE>domain,dc</span>=com"<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><span style='mso-spacerun:yes'> </span><span
class=GramE>filter</span> = "(<span class=SpellE>sAMAccountName</span>=%u)"<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><span style='mso-spacerun:yes'> </span><span
class=GramE>port</span> = 636<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><span style='mso-spacerun:yes'> </span><span
style='mso-spacerun:yes'></span><span class=SpellE>start_tls</span> =
no<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><span style='mso-spacerun:yes'> </span><span
class=SpellE>tls_mode</span> = no<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><span style='mso-spacerun:yes'> </span># <span
class=GramE>Mapping</span> of RADIUS dictionary attributes to LDAP<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><span style='mso-spacerun:yes'> </span># <span
class=GramE>directory</span> attributes.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><span style='mso-spacerun:yes'> </span><span
class=SpellE>dictionary_mapping</span> = ${<span class=SpellE>raddbdir</span>}/<span
class=SpellE>ldap.attrmap</span><o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><span style='mso-spacerun:yes'> </span><span
class=SpellE>ldap_connections_number</span> = 5<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><span style='mso-spacerun:yes'> </span><span
class=SpellE>password_attribute</span> = <span class=SpellE>userPassword</span><o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><span style='mso-spacerun:yes'> </span><span
class=SpellE>groupmembership_filter</span> = "(<span class=GramE>&(</span><span
class=SpellE>objectClass</span>=group)(member=%{<span class=SpellE>Ldap-UserDn</span>}))"<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><span style='mso-spacerun:yes'> </span><span
style='mso-spacerun:yes'></span><span class=SpellE>groupmembership_attribute</span>
= "<span class=SpellE>memberOf</span>"<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><span style='mso-spacerun:yes'> </span><span
class=GramE>timeout</span> = 4<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><span style='mso-spacerun:yes'> </span><span
class=SpellE><span class=GramE>timelimit</span></span> = 3<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><span style='mso-spacerun:yes'> </span><span
class=SpellE>net_timeout</span> = 1<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><span style='mso-spacerun:yes'> </span>}<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>In my users file all I have is:<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>DEFAULT <span class=SpellE>Ldap</span>-Group == "<span
class=SpellE>badgroup</span>", Auth-<span class=GramE>Type :=</span> Reject<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><span style='mso-spacerun:yes'> </span>Reply-Message =
"Sorry, you are not allowed to have access"<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><span class=GramE><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>When I use <span class=SpellE>NTRadPing</span>
to test with a user that is in “<span class=SpellE>badgroup</span>”
I still get an Access-Accept back.</span></font></span><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'><o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>I can do an <span class=SpellE>ldap</span> search using the <span
class=SpellE>groupmembership_filter</span> and I get back all the groups my
test user is in so I know that isn’t the problem. Of course when I do my
search I replace the %<span class=GramE>{<span class=SpellE>Ldap</span></span><span
class=SpellE>-UserDn</span>} with the actual “<span class=SpellE>cn</span>=username,<what
I have for <span class=SpellE>basedn</span>>”<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Also I have the <span class=SpellE>groupmembership_attribute</span>
defined because from what I gather from the docs, it is used if the <span
class=SpellE>groupmembership</span> filter fails.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><span class=SpellE><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>Anywho</span></font></span><font
size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'>, when I
send an auth request while watching the debug output I don’t see anything
about checking for group/<span class=SpellE>groupmembership</span>/etc.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>If I change my filter “filter = "(<span
class=SpellE>sAMAccountName</span>=%u)" to also check for the group name, everything
will work, but of course I would like to use the users file.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>I’ve got TLS set to no and port set to 636 because I
am using a crap-<span class=SpellE>tacular</span> windows 2000 domain, which
doesn’t support TLS </span></font><font size=2 face=Wingdings><span
style='font-size:10.0pt;font-family:Wingdings;mso-ascii-font-family:Arial;
mso-hansi-font-family:Arial;mso-bidi-font-family:Arial;mso-char-type:symbol;
mso-symbol-font-family:Wingdings'><span style='mso-char-type:symbol;mso-symbol-font-family:
Wingdings'>L</span></span></font><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'><o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><span style='mso-spacerun:yes'></span><o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>I think I am missing something or something isn’t
quite right. Anyone have any ideas, or has anyone gotten <span class=SpellE>ldap</span>
group checking to work against active directory??<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Thanks<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial;mso-no-proof:yes'>--</span></font><span style='mso-no-proof:
yes'><o:p></o:p></span></p>
<p class=MsoNormal><st1:PersonName><font size=1 face=Arial><span
style='font-size:8.0pt;font-family:Arial;mso-no-proof:yes'><st1:PersonName>Chris
Liles</span></font></st1:PersonName><font size=1><span style='font-size:8.0pt;
mso-no-proof:yes'><o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face=Arial><span style='font-size:8.0pt;
font-family:Arial;mso-no-proof:yes'></st1:PersonName>System Analyst</span></font><font
size=1><span style='font-size:8.0pt;mso-no-proof:yes'><o:p></o:p></span></font></p>
<p class=MsoNormal><b><font size=1 face=Arial><span style='font-size:8.0pt;
font-family:Arial;font-weight:bold;mso-no-proof:yes'>Air2Web, Inc.</span></font></b><font
size=1><span style='font-size:8.0pt;mso-no-proof:yes'><o:p></o:p></span></font></p>
<p class=MsoNormal><st1:Street><st1:address><font size=1 face=Arial><span
style='font-size:8.0pt;font-family:Arial;mso-no-proof:yes'><st1:Street><st1:address>1230
Peachtree St. N.E.</span></font></st1:address></st1:Street><font size=1><span
style='font-size:8.0pt;mso-no-proof:yes'><o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face=Arial><span style='font-size:8.0pt;
font-family:Arial;mso-no-proof:yes'><st1:Street><st1:address></st1:address></st1:Street></st1:address></st1:Street>12th
Floor</span></font><font size=1><span style='font-size:8.0pt;mso-no-proof:yes'><o:p></o:p></span></font></p>
<p class=MsoNormal><st1:place><st1:City><font size=1 face=Arial><span
style='font-size:8.0pt;font-family:Arial;mso-no-proof:yes'><st1:place><st1:City>Atlanta</st1:City></span></font></st1:City><font
size=1 face=Arial><span style='font-size:8.0pt;font-family:Arial;mso-no-proof:
yes'>, <st1:State></span></font><st1:State><font size=1 face=Arial><span
style='font-size:8.0pt;font-family:Arial;mso-no-proof:yes'>GA</st1:State></span></font></st1:State><font
size=1 face=Arial><span style='font-size:8.0pt;font-family:Arial;mso-no-proof:
yes'> <st1:PostalCode></span></font><st1:PostalCode><font size=1 face=Arial><span
style='font-size:8.0pt;font-family:Arial;mso-no-proof:yes'>30309</span></font></st1:PostalCode></st1:place><font
size=1><span style='font-size:8.0pt;mso-no-proof:yes'><o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><st1:place><st1:PostalCode></st1:PostalCode></st1:place></st1:PostalCode></st1:place><o:p> </o:p></span></font></p>
</div>
</body>
</html>