On 06/13/2015 09:07 PM, William wrote:
Hi,
I have researched this topic and am unable to find examples or previous mailing lists queries about this specific issue.
My issue is NOT using GSSAPI/krb5 to authenticate users and LDAP for user details.
I have LDAP for authentication and user details with EAP, but I wish for the radiusd ldap connections to authenticate to the ldap server with GSSAPI (IE keytab / service account).
The equivalent commands in userspace is:
ldapsearch -Y GSSAPI '(objectClass=*)'
I am unable to find references in the documentation as to how to achieve this.
For example my current setup is:
mods-enabled/ldap
ldap { # ... snip ... identity = "krbprincipalname=radius/example.com,cn=services,cn=accounts,dc=example ,dc=com" password = foo
}
I would hopefully aim to have something akin to:
ldap { # ... snip ... identity = "krbprincipalname=radius/example.com,cn=services,cn=accounts,dc=example ,dc=com" krb5_keytab = /etc/raddb/krb5.keytab krb5_principal = radius/example.com }
Or even a combination of the keytab settings in mods-enabled/krb5 and mods-enabled/ldap.
Does anyone have any experience with such configuration or whether freeradius supports the behaviour I would like to achieve?
Sincerely,
William - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html i vote for this functionality, too.