Hi Am 23.01.2014 21:17, schrieb matrix30003:
Hi My precise configuration: I used MS AD as for user store. I used samba and ntlm_auth to integration with AD. Exactly that's the authentication part you are doing.
Where I will find options about checking group from AD. What you are looking for is is looking up if user X is member in group x or has attribute y, then do $thing which is uthorization. (which is likely at first grant or not grant acccess)
Look at http://wiki.freeradius.org/modules/Rlm_ldap Configure the ldap module and then look at the group support section on the page for i.e. configuration in the post-auth section. 2 AD-specific gotchas: - AD always needs authenticated binds so you need to specify a user FreeRADIUS can authenticate against the AD LDAP to do queries. - AD supports nested groups which requires extra attention if you rely on them. Look out for LDAP_MATCHING_RULE_IN_CHAIN in conjuction with FreeRADIUS. -- Mat