What about the password?

I thought this was a kerberos one and didn’t reside into the ldap itself?

--
Jonathan De Graeve
Network/System Administrator
Imelda vzw
Informatica Dienst
015/50.52.98
jonathan.de.graeve@imelda.be

---------
Always read the manual for the correct way to do things because the number of incorrect ways to do things is almost infinite
---------

---

Van: freeradius-users-bounces@lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Namens Völker, Christian
Verzonden: maandag 14 november 2005 11:22
Aan: freeradius-users@lists.freeradius.org
Onderwerp: Freeradius vs. ActiveDirectory

Yohoo!

Yes! I did it! ;)

My freeradius (1.0.1-1.RHEL3) authenticates again our ActiveDirectory (on 2003 Server). Without ntlm_auth!    

Below I have added a short summary how I realized it here.

But now I have a question and I can't solve it for myself. I want to retreive some group informations from AD. In an users account I find several values "memberOf" and the DN of the group, where the user belong to.

Now I want to give access via freeradius only to some special groups.

I have figuered out, that there are these parameters:

groupname_attribute, groupmembership_filter and groupmembership_attribute

combined with some entries in the users-file.

I've read the doc/rlm_ldap, but I didn't find any deeper hints or explanation.

Questions:

1. Where can I find some docs about the %{...} Values in groupmebership_filter? Which one should I use in combination with my AD?

2. Which value should I use then in the users-file?

3. Is there anyone who can give a little help in further authenticating with group?

-------------short summary how to authenticate vs. ActiveDirectory -----------------------

/etc/raddb/radiusd.conf

[...]

 ldap {
                #servername with an AD-Server running Win2003Srv

                server = "adsrv.qsc.de"

                #The Useraccount for querying AD (anonymous query is disabled)
                identity = "cn=man,ou=ServiceAdmins,dc=qsc,dc=de"

                #The password for the Query-User
                password = 'xxxxxx'

                #base DN for user search; all our Users are in ou=employees. Without this "ou=...", no user will be found. \

                   #I don't understand why
                basedn = "ou=employees,dc=qsc,dc=de"

                # I've copied the below string, because I didn't understand the meanings of the %{...}
                filter = "(sAMAccountname=%{Stripped-User-Name:-%{User-Name}})"
                # I had to increase the timeouts

                timeout = 40
                timelimit = 30
                net_timeout = 10

}

The users-file left on default, no changes.

I hope, I could help some people trying to use AD for radius.

And, I hope, someone will help me with my user-problem.

Greets

Christian