On Sep 21, 2018, at 9:58 AM, Douglas Hammond <wizhippo@gmail.com> wrote:
using freeradius 3 I have pam working well. I use pam to authenticate against winbind and google-authenticator.
I now want to get the user groups from ldap as pam does not pass them along.
PAM only does authentication. And badly. It doesn't really do much else.
I have ldap setup only in authorize. I see the user lookup performed and found but no group lookup is done. When is the group lookup performed?
When the LDAP module is run. If you configure it to do that.
Can I mix ldap authorize with pam authenticate like this or is this not going to work?
It will work. But TBH, PAM is terrible. Don't use it. You should be able to use winbind directly from FreeRADIUS. Google authenticator is a bit harder, but it should be possible.
Is the ldap group lookup dependant on the user ldap authentication being successful?
No. The LDAP module doesn't do authentication. It does user authorization, in the "authorize" section. Alan DeKok.