Hi, Thanks for your answer. I think the issue is caused by the fact that I was using mschap to check AD for membership. I will try to configure ldap module and give you a feedback with debug information if it still doesn't work. Seb. Le mar. 24 sept. 2019 à 20:45, Alan DeKok <aland@deployingradius.com> a écrit :
On Sep 24, 2019, at 2:34 PM, Sébastien Genesta < genesta.sebastien@gmail.com> wrote:
I'm using Freeradius for the Active Directory authentication of my Strongswan clients.
That should be fine.
My goal is to declare 2 vpn connections with different virtual IP leases, allowing me to separate traffic (as an example, one vpn connection for sales and the other for technicians).
To do it, I'm trying to use Group selection option (rightgroups) on Strongswan.
According to Strongswan documentation ( https://wiki.strongswan.org/projects/strongswan/wiki/EapRadius) I have to use class attribute on my freeradius server to return the group membership.
The issue is that I don't know how.
I'm using mschap for authentication to Active Directory.
You can't get group information using mschap. You MUST configure the ldap module to check AD for group membership.
I've tried to follow this post but it didn't work
http://freeradius.1045715.n5.nabble.com/Return-User-Groups-in-Class-field-td...
Define "didn't work". What happened?
More precisaly below part (replacing ldap module by mschap module and also changing path because my freeradius version is 3.0): ... # /etc/raddb/sites-enabled/default post-auth { ... foreach &reply:memberOf { update reply { Class += "%{Foreach-Variable-0}" } } ... }
And... what showed up in the debug output?
Is there any official guide explaning how to reply memberOf attribute?
No.
How can I do it?
The above method *should* work, provided you read the debug output to see what's going on.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html