Peter Bushnell wrote:
Hello All,
Have a working FreeRADIUS server up and running, this is used for authenticating student users on to a wireless network against a M$ 2003 server with Active Directory using LDAP.
Problem is I only seem to be able to authenticate users against one OU, if I set the basedn simply to the domain the server just sits there and never returns an accept or reject.
What is the basedn that doesn't work? dc=bnc,dc=ox,dc=ac,dc=uk or dc=ox,dc=ac,dc=uk? I suspect it's something related to all that AD crap about forests and referrals and such. Do you have an interdomain trusts? Can you use a command-line ldapsearch with those settings (the ones that never return)? If so, what is the output? If it *is* that, you may try this in /etc/openldap/ldap.conf (or whatever path that file lives at): # This *may* cause problems if multiple forests are used with AD. deref never referrals no Also, you didn't mention which version of FR you're using.
So how can I set my FR box to authenticate against all users in AD?
Here is my LDAP cfg from radiusd.conf…
ldap {
server = "brassbullet.bnc.ox.ac.uk"
identity = "cn=administrator,cn=users,dc=bnc,dc=ox,dc=ac,dc=uk"
password = password
basedn = "ou=students,dc=bnc,dc=ox,dc=ac,dc=uk"
filter ="(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})"
start_tls = no
ldap_connections_number = 5
password_attribute = userPassword
timeout = 4
timelimit = 3
net_timeout = 1
compare_check_items = yes
}
Any help appreciated,
Peter Bushnell IT Officer Brasenose College Email: peter.bushnell@bnc.ox.ac.uk <mailto:peter.bushnell@bnc.ox.ac.uk> Tel: +44 1865 277513
------------------------------------------------------------------------
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html