On Mon, 18 Mar 2024, Andrei Katsuk wrote:
Hello, I use rlm_ldap to authenticate users in the AD directory. Part of my ldap config:
identity = cn=admin,cn=users,dc=example,dc=com base_dn = cn=users,dc=example,dc=com
filter = "(userPrincipalName=%{%{Stripped-User-Name}:-%{User-Name}})"
So I can use upn form for authentication, for example echo "User-Name=user@example.com,User-Password=password" | radclient localhost:1812 auth testing123 -x
Is it possible for rlm_ldap to use not only upn form, but also SAMCompatibleName form like echo "User-Name=REALM\user,User-Password=password" | radclient localhost:1812 auth testing123 -x ?
Thanks, Andrei
Are you sure about that 'SAMCompatibleName' attribute name? Our AD forest only has 'sAMAccountName' and it doesn't contain the "REALM\" part of the value only "sAMAccountName=user". Be that as it may, the way to do that is to augment your search filter using LDAP syntax: filter = "(|(userPrincipalName=%{%{Stripped-User-Name}:-%{User-Name}})(sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}))" Adjust that 'sAMAccountName' attribute name to meet your needs. -- Dave Funk University of Iowa <dbfunk (at) engineering.uiowa.edu> College of Engineering 319/335-5751 FAX: 319/384-0549 1256 Seamans Center, 103 S Capitol St. Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527 #include <std_disclaimer.h> Better is not better, 'standard' is better. B{