Hi Harry, So this is the way I understand it. The authenticate section is used to just verify that you are who you are, via certs, username/password, token etc. The authorize section is where you define the sources for all the information you want FR to respond to. So to just authenticate someone you would just need the authenticate section but if you wanted FreeRadius to assign a user to a specific vlan then you need to configure where that information is coming from which is defined in the authorize section. For example, and this is a guess because I have never tried it. You can have AD as the authenticator in the authenticate section then have "local" in the authorization section. The AD makes sure Harry is Harry, if there is a user name Harry in the Local user file with information on what vlan he belongs to then it will send that information to the switch/router or what have you. Usually you set the Authenticate and authorize to the same servers though so the authenticate server pushes down the info for authorization as well. Anyway, I hope that helps and I am not giving you bad info:) Brett Littrell Network Manager MUSD CISSP, CCSP, CCVP, MCNE
On Tuesday, February 01, 2011 at 1:07 PM, in message <1296594437.13427.45.camel@localhost.localdomain>, Harry Hoffman <hhoffman@ip-solutions.net> wrote:
Right, I do understand the distinction which is why I asked the question. I didn't know if the tutorial just assumed everyone was authorized and then granted access as long as the userid/password matched AD or if there's something missing that should be addressed in authorize. Cheers, Harry On Tue, 2011-02-01 at 20:48 +0000, Alan Buxey wrote:
Hi,
I'm trying to find out what to use (if anything) in the authorize section when authenticating clients via MSCHAP-v2 and AD credentials.
The how-to at deployingradius.com only speaks to the authentication section.
If I only want to ensure that the username/password credentials are valid do I need to run through authorize or just go straight to authenticate?
authorise - CAN i use the network
authenticate - is my ID and password correct
once you get that and understand the very clear difference, then you can decide if you want to deal with authorise - and how to deal with it.
alan
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html