Re: Issues getting SLES11 FreeRadius working with eDirectory

Brian Boere wrote:

Chris, I have added the "edir = yes" (also found some information about also adding edir_autz = yes) and it did not make a difference.

AFAIK edir = yes uses a Novell-specific LDAP extended operation for extracting the Universal Password from eDirectory as clear-text. Not sure whether your security policy allows that. Personally I'd recommend not to use it. But that's me. Special admin rights are needed in eDirectory for the FreeRADIUS system user to be allowed to do that. IIRC you also must use an encrypted LDAP connection (LDAPS or StartTLS ext op.) when using this particular LDAP extended operation. That's probably what Christopher meant with "Modify the port you connect to eDirectory [..]". Ciao, Michael.