<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EstiloCorreo17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 3.0cm 70.85pt 3.0cm;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=ES link=blue vlink=purple><div class=WordSection1><p class=MsoNormal>Hello there,<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span lang=EN-US>I’m trying to deploy a FreeRadius server with OpenLDAP. To this end, both are working properly and communicate with each other successfully. I have LDAP groups set up so users belong to a group and I can check from freeradius’ users file if a user belongs to a group (and, for example, deny access to all users belonging to a certain group). I must say that, if I enable group checking in users file, I can see rlm_ldap debug info about it searching for group information; but if it’s not enabled it doesn’t search for groups.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>The issue here is that the server will be used to authenticate wifi users from a Ruckus ZoneDirector device, which defines roles and assigns roles to the users depending on the groups that the users belong to. This works flawlessly when authenticating against LDAP itself, but if freeradius stands in the middle the group info gets lost somewhere. I know that freeradius can access Ldap-Group variable and know which group the user belongs to, but I’d like it to forward that info to the ZoneDirector (who is actually performing the authentication request against freeradius), so that it can assign the role properly.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>The LDAP database is set up with two OUs, users and groups, and users being of objectClass inetOrgPerson and groups being groupOfNames. In freeradius, ldap config is mostly default except for server, identity, etc, but with these group-related parameters:<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>groupname_attribute = cn<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>groupmembership_filter = (&(objectClass=groupOfNames)(member=%{control:Ldap-UserDn}))<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>groupmembership_attribute = member # (also tried with memberOf, radiusGroup, radiusGroupName and several others)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>And, about the server, it is running Debian 7.5, OpenLDAP 2.4.31 and freeradius 2.1.12 (default packages from debian). I can provide any other info that you need :)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>Thanks everyone in advance!<o:p></o:p></span></p></div></body></html>