Dear Alan, we just have a Freeradius server deployed according to the howto you point. It works OK now. But we have to use LDAP authentication against an AD server, because in the near future we have to use the "ldap-group" attribute in order to group wifi users by SSID, and let them use different wifi networks. So if I use the server I have developed according to your guide with NTLM and MSCHAP2, I won't can use the "lda-group" attribute. So I think we have to use LDAP authentication and authorization mandatory. Please confirm to me if I am ok or not, because maybe using your recommended configuration I can add the ldap-group attribute in order to select group of users by SSID. Thanks a lot again. ADAM 2017-08-14 17:01 GMT-03:00 Alan DeKok <aland@deployingradius.com>:
On Aug 14, 2017, at 9:26 PM, Adam Cage <adamcage27@gmail.com> wrote:
Hi people, we wanna authenticate WiFi users against a Freeradius 3.x server, these users are defined in a Windows Active Directory remote server.
Follow the guide here: http://deployingradius.com/ documents/configuration/active_directory.html
We have the base_dn search defined, and there they are all the valid users who can use the WiFi service.
We wanna use LDAP to initially authenticate and in the future authorize the accesses.
For PEAP, no, that doesn't work. AD isn't really an LDAP server.
Please can anybody point to me a detailed howto, because we are confused if we have to use LDAP with MSCHAP, PAP, EAP or whatever???
Follow the guide above. It will work.
Aand also we are confused about the AD object we have to use in the filter string: uid, samaccountname, mail...What does this selection depend on ???
It depends on what you want to do. Where are the user accounts in AD?
And the last question: I'm using a Debian server with the freeradius and freeradius-ldap distribution packages, is it a good idea or maybe it's better to use the tar.gz version???
Use 3.0.15. The debian versions are typically years out of date.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html