RE: AD group and Reply Attribute

22 Feb 2022

      ntlm_auth not used.

You can just configure ldap module (mods-avalible/ldap):

	server = 'YOU_IP'
	port = 389 
	identity = 'CN=std,OU=IT,OU=FDM,DC=test,DC=com'
	password = 1
	base_dn = 'dc=test,dc=com'

# and change user,group filter for Active Directory:

user {
	filter = "(sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})"
}

group {

	filter = '(objectClass=group)'
}

Next modify (sites-avalible/default):

# in authorize section add :

authorize {
         -ldap
         if ((ok || updated) && User-Password && !control:Auth-Type) {
             update {
                 control:Auth-Type := ldap
             }
         }

}

# in authenticate section add :

authenticate {
	Auth-Type LDAP {
		ldap
	}
}

As far as I remember, freeradius recommended use policy in post_auth section to assign vlan.

# my policy vlan assign (policy.d/vlan_policy)

vlan_assignment {
    if (&control:Auth-Type == ldap) {
	if (LDAP-Group == "CN=SOMEGROUP,OU=OU=Groups,OU=TEST,DC=company,DC=com") {
	    update reply {
	    Tunnel-Type := VLAN
	    Tunnel-Medium-Type := IEEE-802
	    Tunnel-Private-Group-ID := 21
	    }
	}
	else {
	    reject
	}
    }
}

You can use radtest (linux util) for debug your radius server
...
-----Original Message-----
From: Freeradius-Users [mailto:freeradius-users-
bounces+moskalevas=energomera.ru@lists.freeradius.org] On Behalf Of
ReZa Esfahani
Sent: Tuesday, February 22, 2022 2:03 PM
To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org>
Subject: Re: AD group and Reply Attribute
i use samba to integrate my AD with Freeradius and i think it use ntlm-
auth.but i don't know that is it necessary to use ldap module or not  for
sending attribute to nas for different group or not ?
On Tue, Feb 22, 2022 at 1:05 PM Москалев Артем Сергеевич
<MoskalevAS@energomera.ru> wrote:
...
Hi, ldap connect success? Need debug output
...
-----Original Message-----
From: Freeradius-Users [mailto:freeradius-users-
bounces+moskalevas=energomera.ru@lists.freeradius.org] On Behalf Of
ReZa Esfahani
Sent: Tuesday, February 22, 2022 12:24 PM
To: Free Radius Mailing list <freeradius-users@lists.freeradius.org>
Subject: AD group and Reply Attribute
Hello,
I have Microsoft Active Directory as a users database in my company.
i have
10 Different Group in my AD and i want to send  specific attributes
for each group to NAS, I also integrate my AD with freeradius, but i
don't know how to send these attribute to nas and i dont know where i
...
...
users file
.......................................
DEFAULT Ldap-Group ==
...
Service-Type = Framed-User,
  Framed-Protocol = PPP,
  Tunnel-Medium-Type = 802 (includes all 802 media plus Ethernet
"canonical format"),
  Tunnel-Private-Group-ID = 15
  Tunnel-Type = Virtual Lans (VLAN)
...........................................................
mods-enabled > ldap module
..........................................................
ldap {
server = 'active.test.com'
    identity = 'CN=std,OU=IT,OU=FDM,DC=test,DC=com'
    password = 1
    base_dn = 'dc=test,dc=com'
}
...........................................................................................
site-enabled > default
.........................................................
in authorize section  uncomment ldap
-
List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html
"CN=student,OU=IT,OU=FDM,DC=test,DC=com",
-
List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html
made mistake?
-
List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html

RE: AD group and Reply Attribute

Москалев Артем Сергееви ч