You can take care of #1 by still doing LDAP to AD for the groups, but using ntlm for the password authentication. This seems counterproductive, unless you are using a backside encryption where you need to do it that way, which is what I ended up having to do.
<br><br><br><br><br><br><div><span class="gmail_quote">On 4/30/07, <b class="gmail_sendername">Jacob Jarick</b> <<a href="mailto:mem.namefix@gmail.com">mem.namefix@gmail.com</a>> wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
Thanks for the Tip ryan but I have been down that road and 2 reasons stopped me:<br><br>1 - no way of retrieving ldap groups<br>2 - Been requested not to have samba on the machine.<br><br>ntlm_auth was very straight forward for me because it supports all the
<br>encryption methods.<br><br>On 5/1/07, Ryan Kramer <<a href="mailto:rkramer@gmail.com">rkramer@gmail.com</a>> wrote:<br>> depending on the wifi auth method, you may want to also investigate a<br>> NTLM_AUTH method instead of straight ldap. This requires the freeradius
<br>> machine to be a member of the domain, but once you do that it works great.<br>><br>><br>><br>><br>> On 4/29/07, Jacob Jarick <<a href="mailto:mem.namefix@gmail.com">mem.namefix@gmail.com</a>> wrote:
<br>> > OK tried with 1.1.4 and yerp works great.<br>> ><br>> > radiusd -X output: <a href="http://pastebin.ca/464153">http://pastebin.ca/464153</a><br>> > radiusd.conf: <a href="http://pastebin.ca/464156">
http://pastebin.ca/464156</a><br>> ><br>> > I also realised a mistake I have been making, see I want to search the<br>> > whole active directory, hence I kept setting my basedn without an ou.<br>> > After seeing your excellent example and auth'ing had failed I stuck in
<br>> > an OU and tried a user from the OU and worked fine.<br>> ><br>> > So my questions is this, to auth people from multiple OU's do I create<br>> > a new ldap module for each OU or is their a simpler way.
<br>> ><br>> > Thanks Very much for your help Phil, its been a very productive<br>> > weekend thanks to the info you provided.<br>> ><br>> > My challenge for monday will be setting up the cisco and wireless clients
<br>> now :)<br>> ><br>> > On 4/29/07, Jacob Jarick <<a href="mailto:mem.namefix@gmail.com">mem.namefix@gmail.com</a> > wrote:<br>> > > radiusd.conf: <a href="http://pastebin.ca/464133">http://pastebin.ca/464133
</a><br>> > > radius -X ouput: <a href="http://pastebin.ca/464138">http://pastebin.ca/464138</a><br>> > ><br>> > > Tried with 1.1.6 and fails with this error:<br>> > ><br>> > > rlm_ldap: reading ldap<->radius mappings from file
<br>> /etc/raddb/ldap.attrmap<br>> > > rlm_ldap: Opening file /etc/raddb/ldap.attrmap failed<br>> > > rlm_ldap: Reading dictionary mappings from file /etc/raddb/ldap.attrmap<br>> failed<br>> > >
radiusd.conf[540]: ldap: Module instantiation failed.<br>> > > radiusd.conf[586] Unknown module "ldap".<br>> > > radiusd.conf[586] Failed to parse "ldap" entry.<br>> > > -----------------------------
<br>> > > /etc/raddb/ldap.attrmap does exist as provided by the rpm.<br>> > ><br>> > > [root@localhost src]# ls -l /etc/raddb/ldap.attrmap<br>> > > -rw-r----- 1 root root 2424 Apr 19 16:32 /etc/raddb/ldap.attrmap
<br>> > ><br>> > > I assume the permissions are correct, as it was installed by rpm. Im<br>> > > building the 1.1.4 rpm now, will report back once done.<br>> > ><br>> > > On 4/29/07, Jacob Jarick <
<a href="mailto:mem.namefix@gmail.com">mem.namefix@gmail.com</a>> wrote:<br>> > > > Thanks for the very detailed instructions.<br>> > > ><br>> > > > I will attempt this shortly (bought rad & ad servers home for weekend
<br>> study).<br>> > > ><br>> > > > Quite possible the biggest learning curve for me is the ldap fields<br>> > > > but I am finally starting to get familar with them.<br>> > > >
<br>> > > > Cheers again, will post back once Ive run the radtest.<br>> > > ><br>> > > > On 4/28/07, Phil Mayers <<a href="mailto:p.mayers@imperial.ac.uk">p.mayers@imperial.ac.uk</a>
> wrote:<br>> > > > > I haven't been following your (quite extensive) queries, so<br>> apologies if<br>> > > > > I've missed something fundamental.<br>> > > > ><br>
> > > > > I honestly don't know why this is proving so difficult. I've just<br>> tested<br>> > > > > this against our own 2k3 AD service, and although I'm pretty<br>> familiar
<br>> > > > > with FR it took under 5 minutes. Try following the instructions<br>> below.<br>> > > > > These were tested with FreeRadius 1.1.4<br>> > > > ><br>> > > > > 1. First, create or locate an existing account which FreeRadius can
<br>> bind<br>> > > > > and do it's searches as. Record the following variables:<br>> > > > ><br>> > > > > SEARCHDN=<the DN of the account><br>> > > > > SEARCHPW=<the password>
<br>> > > > > BASEDN=<the DN below which all your accounts live in AD><br>> > > > > ADHOST=<hostname of the AD controller you'll search against><br>> > > > ><br>
> > > > > For example, these might be:<br>> > > > ><br>> > > > > SEARCHDN=CN=freeradius,OU=Users,OU=My<br>> Site,DC=mysite,DC=com<br>> > > > > SEARCHPW=blahblah
<br>> > > > > BASEDN=OU=My Site,DC=mysite,DC=com<br>> > > > ><br>> > > > > 2. Next, take the default "radiusd.conf"<br>> > > > ><br>> > > > > 3. Find the start of the modules section:
<br>> > > > ><br>> > > > > modules {<br>> > > > > ...<br>> > > > ><br>> > > > > Delete this line and all the following lines<br>> > > > >
<br>> > > > > 4. Insert the following config:<br>> > > > ><br>> > > > > modules {<br>> > > > > ldap {<br>> > > > > server = "$ADHOST"
<br>> > > > > identity = "$SEARCHDN"<br>> > > > > password = "$SEARCHPW"<br>> > > > ><br>> > > > > basedn = "$BASEDN"
<br>> > > > > filter =<br>> "(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})"<br>> > > > ><br>> > > > > dictionary_mapping = ${raddbdir}/ldap.attrmap
<br>> > > > ><br>> > > > > ldap_connections_number = 5<br>> > > > > timeout = 4<br>> > > > > timelimit = 3<br>> > > > > net_timeout = 1
<br>> > > > > }<br>> > > > ><br>> > > > > preprocess {<br>> > > > > huntgroups = ${confdir}/huntgroups<br>> > > > > hints = ${confdir}/hints
<br>> > > > ><br>> > > > > with_ascend_hack = no<br>> > > > > ascend_channels_per_line = 23<br>> > > > ><br>> > > > > with_ntdomain_hack = no
<br>> > > > > with_specialix_jetstream_hack = no<br>> > > > > with_cisco_vsa_hack = no<br>> > > > > }<br>> > > > ><br>> > > > > detail {
<br>> > > > > detailfile =<br>> ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d<br>> > > > > detailperm = 0644<br>> > > > > }<br>> > > > ><br>> > > > > }
<br>> > > > ><br>> > > > > instantiate {<br>> > > > > }<br>> > > > ><br>> > > > > authorize {<br>> > > > > preprocess<br>> > > > >
<br>> > > > > ldap<br>> > > > > }<br>> > > > ><br>> > > > > authenticate {<br>> > > > > Auth-Type LDAP {<br>> > > > > ldap
<br>> > > > > }<br>> > > > > }<br>> > > > ><br>> > > > ><br>> > > > > preacct {<br>> > > > > preprocess<br>> > > > > }
<br>> > > > ><br>> > > > > accounting {<br>> > > > > detail<br>> > > > > }<br>> > > > ><br>> > > > ><br>> > > > > session {
<br>> > > > > }<br>> > > > ><br>> > > > > post-auth {<br>> > > > > }<br>> > > > ><br>> > > > > pre-proxy {<br>> > > > > }
<br>> > > > ><br>> > > > > post-proxy {<br>> > > > > }<br>> > > > ><br>> > > > > 5. Start the server with -X<br>> > > > ><br>> > > > > 6. Run "radtest" to send a checking PAP request
<br>> > > > ><br>> > > > > It should work.<br>> > > > ><br>> > > > > The above config is the ABSOLUTE BARE MINIMUM server config which<br>> will<br>> > > > > check PAP requests ONLY against an AD LDAP server. I do NOT
<br>> recommend<br>> > > > > you go into service with this config. Try to look at it, understand<br>> how<br>> > > > > it's doing what it's doing, *then* start again with the default
<br>> > > > > FreeRadius config and make the absolute minimum changes to get back<br>> to<br>> > > > > that point.<br>> > > > > -<br>> > > > > List info/subscribe/unsubscribe? See
<br>> <a href="http://www.freeradius.org/list/users.html">http://www.freeradius.org/list/users.html</a><br>> > > > ><br>> > > ><br>> > ><br>> > -<br>> > List info/subscribe/unsubscribe? See
<br>> <a href="http://www.freeradius.org/list/users.html">http://www.freeradius.org/list/users.html</a><br>> ><br>><br>><br>> -<br>> List info/subscribe/unsubscribe? See<br>> <a href="http://www.freeradius.org/list/users.html">
http://www.freeradius.org/list/users.html</a><br>><br>-<br>List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html">http://www.freeradius.org/list/users.html</a><br></blockquote></div><br>