<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Ok. it's working. I found it "helpful" to use the correct base dn
when searching for group membership.<br>
<br>
Ya gotta love self-inflicted wounds...<br>
<br>
Jeff Davis wrote:
<blockquote cite="mid:4A3683F6.3040006@standard.k12.ca.us" type="cite">
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
The two things I have changed to get it working are:<br>
<br>
in users:<br>
<tt>DEFAULT Auth-Type := LDAP<br>
Service-Type = NAS-Prompt-User,<br>
cisco-avpair = <a moz-do-not-send="true"
class="moz-txt-link-rfc2396E" href="shell:priv-lvl=15">"shell:priv-lvl=15"</a>,<br>
Fall-Through = 1</tt><br>
<br>
and added on the switch:<br>
<br>
<tt>aaa authorization exec default group radius local<br>
aaa authorization network default group radius local</tt><br>
<br>
Next - ldapgroupfilter.<br>
<br>
I have a group of users called "radiususers" - and the following in
radiusd.conf:<br>
<br>
<tt>groupname_attribute = cn<br>
groupmembership_filter =
(&(objectClass=posixGroup)(memberUid=%{Stripped-User-Name:-%{User-Name}}))</tt><br>
<br>
and in users:<br>
<br>
<tt>DEFAULT LDAP-Group == radiususers<br>
Service-Type = Administrative-User</tt><br>
<br>
But any ldap user can sill login regardless of group membership.<br>
<br>
Where am I screwing up?<br>
<br>
Thanks,<br>
<br>
-Jeff<br>
<br>
<br>
Ivan Kalik wrote:
<blockquote
cite="mid:54105.87.194.16.13.1244673846.squirrel@webmail.kalik.net"
type="cite">
<blockquote type="cite">
<pre wrap="">19:23:13: RADIUS: no appropriate authorization type for user.
I am all but certain this is a self-inflicted wound.
</pre>
</blockquote>
<pre wrap=""><!---->
It is. Have a look at your aaa configuration. Do you see an authorization
line anywhere?
Ivan Kalik
Kalik Informatika ISP
-
List info/subscribe/unsubscribe? See <a moz-do-not-send="true"
class="moz-txt-link-freetext"
href="http://www.freeradius.org/list/users.html">http://www.freeradius.org/list/users.html</a>
</pre>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
Jefferson K Davis
Technology & Information Systems Manager
Standard School District
1200 North Chester Ave
Bakersfield, CA 93308
USA
661.392.2110 ext 120</pre>
<pre wrap="">
<hr size="4" width="90%">
-
List info/subscribe/unsubscribe? See <a class="moz-txt-link-freetext" href="http://www.freeradius.org/list/users.html">http://www.freeradius.org/list/users.html</a></pre>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
Jefferson K Davis
Technology & Information Systems Manager
Standard School District
1200 North Chester Ave
Bakersfield, CA 93308
USA
661.392.2110 ext 120</pre>
</body>
</html>