Using radius to determine a users group membership.
All, I am not that familiar with radius so I was hoping a guru could help me out. Using a radius client library, I would like to be able to determine if a given user is a member of a given group. It would be preferable to use a method to somehow query this information ad-hock. As an alternative, if the server could be coaxed into returning the users membership information ( maybe during user authentication? ), that would work as well. I noticed that there are several keywords in the standard dictionary file that have to do with groups but am not sure what they are used for. If someone knows how to accomplish this, could they kindly point me to some documentation that describes the method? I tried sifting through the RFC's, the freeradius FAQ and the freeradius mailing list archives but had no luck. The client library I am using is radlib which is bundled with FreeBSD 6.x. The freeradius server I have configured is using the unix authentication module to query the system password and group databases. Thanks in advance, -Matthew
Matthew Grooms <mgrooms@shrew.net> wrote:
I am not that familiar with radius so I was hoping a guru could help me out. Using a radius client library, I would like to be able to determine if a given user is a member of a given group.
That information has to go into the RADIUS reply packet, in an attribute. See share/dictionary.unix for one example.
If someone knows how to accomplish this, could they kindly point me to some documentation that describes the method?
It's an unusual enough request that there's no documentation detail exactly how to do it. It falls under the generic idea of "configure the server to send attribute X with value Y". Alan DeKok.
participants (2)
-
Alan DeKok -
Matthew Grooms