Hi...<br><br>i able to get the openldap group authentication + PAP with radius , i used the following settings ,<br><br>in users file ,<br><br>DEFAULT Ldap-Group == "cn=staff,ou=groups,dc=openldap,dc=ihk,dc=com"<br>
Reply-Message = "You are Accepted"<br><br>DEFAULT Auth-Type := Reject<br><br><br>and in /etc/freeradius/moduls/ldap <br><br> server = "<a href="http://ldap.ihx.com">ldap.ihx.com</a>"<br> identity = "cn=admin,dc=openldap,dc=ihx,dc=com"<br>
password = abc<br> basedn = "dc=openldap,dc=ihx,dc=com"<br> filter = "(mail=%{Stripped-User-Name:-%{User-Name}})"<br> access_attr = "mail"<br> authtype = ldap<br>
<br><br><br>and uncomment the following lines in the /etc/freeradius/modules/ldap <br><br> groupname_attribute<br> groupmembership_filter<br>
groupmembership_attribute <br><br>hope this helps,<br>
<br>
<br>
Thank You<br><br><div class="gmail_quote">On 26 June 2012 20:44, Julson, Jim <span dir="ltr"><<a href="mailto:jjulson@marketron.com" target="_blank">jjulson@marketron.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Forgive my ignorance, but the variable that you are suggesting I use would be something that I had to create locally on my RADIUS servers right? The idea is that we use our central point of management which in our case is Active Directory. We have hundreds of servers ranging from RHEL 3 up to Ubuntu 12.04 as well as Windows boxes. So managing groups on a "per radius server" basis isn't really a good choice from a management perspective. Using the Active Directory domain, we can have our admins move folks in and out of groups as necessary.<br>
<br>
Did I understand your suggestion right? Or is that variable "--require-membership-of=" something that can help me achieve what I want to do? I thought I had to use LDAP for Group Authorization...<br>
<div class="im HOEnZb"><br>
-----Original Message-----<br>
From: freeradius-users-bounces+jjulson=<a href="mailto:marketron.com@lists.freeradius.org">marketron.com@lists.freeradius.org</a> [mailto:<a href="mailto:freeradius-users-bounces%2Bjjulson">freeradius-users-bounces+jjulson</a>=<a href="mailto:marketron.com@lists.freeradius.org">marketron.com@lists.freeradius.org</a>] On Behalf Of NdK<br>
Sent: Tuesday, June 26, 2012 3:36 AM<br>
To: <a href="mailto:freeradius-users@lists.freeradius.org">freeradius-users@lists.freeradius.org</a><br>
Subject: Re: Can't figure out Group Authentication<br>
<br>
</div><div class="HOEnZb"><div class="h5">Il 22/06/2012 17:32, Julson, Jim ha scritto:<br>
<br>
> Now, the problem is this. Following Alan DeKok's guide at <a href="http://deployingradius.com/documents/configuration/active_directory.html" target="_blank">http://deployingradius.com/documents/configuration/active_directory.html</a>, I was able to get FreeRADIUS 2.X running on CentOS 6.2 with pretty minimal effort. There were a few things I had to go elsewhere to figure out, but I managed. I have FreeRADIUS setup and authenticating using NTLM_AUTH. I was able to join my AD 2008 R2 Domain, I can list users, groups etc.. This RADIUS server will be for authenticating users on all of our Cisco devices, as well as remote access VPN users. So the problem is this. It's authenticating...a little too well.<br>
<br>
<br>
<br>
Why not add a "default group" var (to be overridden for specific<br>
clients) and pass it to ntlm_auth in "--require-membership-of="<br>
parameter? That way you can filter who can authenticate from any NAS.<br>
And IIUC huntgroups, you can even define groups of clients...<br>
<br>
Please correct me if I'm wrong.<br>
<br>
BYtE,<br>
Diego.<br>
-<br>
List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br>
</div></div><div class="im HOEnZb">The information contained in this e-mail message may be confidential and<br>
protected from disclosure. If you are not the intended recipient, any<br>
dissemination, distribution or copying is strictly prohibited. If you<br>
think that you have received this e-mail message in error, please notify<br>
the sender immediately by replying to this message and then delete it<br>
from your system.<br>
<br>
</div><div class="HOEnZb"><div class="h5">-<br>
List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br>
</div></div></blockquote></div><br>