<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7638.1">
<TITLE>Tricky problem with ldap and primary groups in AD</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/rtf format -->
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">Hi All,</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri"> I’ve been searching for half the day and can’t find an answer for a question I have.</FONT></SPAN><SPAN LANG="en-gb"><FONT FACE="Calibri"> I’m new to freeradius and so far am finding it a rewarding challenge.</FONT></SPAN><SPAN LANG="en-gb"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">I ha</FONT></SPAN><SPAN LANG="en-gb"><FONT FACE="Calibri">ve</FONT></SPAN><SPAN LANG="en-gb"><FONT FACE="Calibri"> freeradius 2.1</FONT></SPAN><SPAN LANG="en-gb"><FONT FACE="Calibri">.10 up and running, querying AD via ldap and authenticating with ntlm_auth</FONT></SPAN><SPAN LANG="en-gb"><FONT FACE="Calibri"> fine.</FONT></SPAN><SPAN LANG="en-gb"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">I’m using Ldap-Group</FONT></SPAN><SPAN LANG="en-gb"> <FONT FACE="Calibri">checks</FONT></SPAN><SPAN LANG="en-gb"> <FONT FACE="Calibri">within the users file to check against the AD groups. The problem I have is that the</FONT></SPAN><SPAN LANG="en-gb"> <FONT FACE="Calibri">NAS</FONT></SPAN><SPAN LANG="en-gb"> <FONT FACE="Calibri">we</FONT></SPAN><SPAN LANG="en-gb"><FONT FACE="Calibri">’re</FONT></SPAN><SPAN LANG="en-gb"><FONT FACE="Calibri"> work</FONT></SPAN><SPAN LANG="en-gb"><FONT FACE="Calibri">ing</FONT></SPAN><SPAN LANG="en-gb"><FONT FACE="Calibri"> with (cisco wireless Aps</FONT></SPAN><SPAN LANG="en-gb"><FONT FACE="Calibri">) does both mac address and PEAP-MSCHAPv2</FONT></SPAN><SPAN LANG="en-gb"> <FONT FACE="Calibri">authentication to join the SSID</FONT></SPAN><SPAN LANG="en-gb"><FONT FACE="Calibri">. The PEAP bit works ok, but for the mac address bit the AD administrators set a user up on AD with the mac address</FONT></SPAN><SPAN LANG="en-gb"> <FONT FACE="Calibri">but with only one primary group</FONT></SPAN><SPAN LANG="en-gb"><FONT FACE="Calibri"> set which dictates the vlan passed back to that particular user on a specific client machine. The Ldap-Group doesn’t see the primary group as it’s set to do a</FONT></SPAN><SPAN LANG="en-gb"> <FONT FACE="Calibri">“memberof” lookup. Other groups are seen fine.</FONT></SPAN><SPAN LANG="en-gb"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">There a</FONT></SPAN><SPAN LANG="en-gb"><FONT FACE="Calibri">re</FONT></SPAN><SPAN LANG="en-gb"><FONT FACE="Calibri"> 3 ways I can see</FONT></SPAN><SPAN LANG="en-gb"><FONT FACE="Calibri"> this working :</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">1) </FONT></SPAN><SPAN LANG="en-gb"></SPAN><SPAN LANG="en-gb"></SPAN><SPAN LANG="en-gb"></SPAN><SPAN LANG="en-gb"> <FONT FACE="Calibri">Get the</FONT></SPAN><SPAN LANG="en-gb"> <FONT FACE="Calibri">LDAP</FONT></SPAN><SPAN LANG="en-gb"><FONT FACE="Calibri"> bods to assign a different primary group</FONT></SPAN><SPAN LANG="en-gb"><FONT FACE="Calibri"> and use the other group to dictate vlan membership</FONT></SPAN><SPAN LANG="en-gb"><FONT FACE="Calibri">. We’ve 5000 odd clients so this isn’t my favourite.</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">2) </FONT></SPAN><SPAN LANG="en-gb"></SPAN><SPAN LANG="en-gb"> <FONT FACE="Calibri">Check the primarygroupid attribute out by mapping it using ldap.attrmap and attributes in the dictionary file, but then as far as I can tell I can’t use these as checkitems within the users file. It’s also tedious to have to know the primarygroupIDs</FONT></SPAN><SPAN LANG="en-gb"> <FONT FACE="Calibri">for each group. I’d quite like the users file to be the main source of passing radius attributes back to clients, but there may be another way?</FONT></SPAN><SPAN LANG="en-gb"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">3) </FONT></SPAN><SPAN LANG="en-gb"> <FONT FACE="Calibri">Something else a bit more clever. I</FONT></SPAN><SPAN LANG="en-gb"><FONT FACE="Calibri">’ve seen various examples of java / vb.net/php etc ways of taking the primarygroupid, changing it’s data type and thus finding the group name, which could then maybe be passed back to the users file. I have absolutely no idea here.</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"></SPAN><SPAN LANG="en-gb"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">Can some please help?</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">Thanks</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">Andy Franks</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri"></FONT></SPAN><SPAN LANG="en-gb"> </SPAN></P>
</BODY>
</HTML>