Hi, I managed to get authentication of users logged on Windows XP workstation to the network. The machine authentication (while booting) however fails thus preventing the users from retrieving their roaming profiles. Here is the relevant part of the log: Thu Feb 5 14:39:16 2009 : Debug: rlm_ldap: - authorize Thu Feb 5 14:39:16 2009 : Debug: rlm_ldap: performing user authorization for host/mycomputer Thu Feb 5 14:39:16 2009 : Debug: radius_xlat: Running registered xlat function of module mschap for string 'User-Name:None' Thu Feb 5 14:39:16 2009 : Debug: expand: (uid=%{mschap:User-Name:None}) -> (uid=mycomputer$) Thu Feb 5 14:39:16 2009 : Debug: expand: ou=People,dc=mycompany,dc=com -> ou=People,dc=mycompany,dc=com Thu Feb 5 14:39:16 2009 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Thu Feb 5 14:39:16 2009 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Thu Feb 5 14:39:16 2009 : Debug: rlm_ldap: attempting LDAP reconnection It seems freeradius "tries" to authenticate the computer from the ou=People,dc=mydomain,dc=com. In radiusd.conf I have the following: ldap { server = "192.168.0.3" identity = "uid=dot1x_read_user,ou=People,dc=mydomain,dc=com" password = ldapreadpasswd basedn = "ou=People,dc=mydomain,dc=com" filter = "(uid=%{mschap:User-Name:None})" I now need to instruct the ldap to search in ou=Computers,dc=mydomain,dc=com for the computers authentication. How do I do this while preserving the working users auth ? Thanks Laurent
It seems freeradius "tries" to authenticate the computer from the ou=People,dc=mydomain,dc=com.
In radiusd.conf I have the following: ldap { server = "192.168.0.3" identity = "uid=dot1x_read_user,ou=People,dc=mydomain,dc=com" password = ldapreadpasswd basedn = "ou=People,dc=mydomain,dc=com" filter = "(uid=%{mschap:User-Name:None})"
I now need to instruct the ldap to search in ou=Computers,dc=mydomain,dc=com for the computers authentication.
How do I do this while preserving the working users auth ?
Make another ldap instance that has that basedn. Machine usernames have $ at the end - use unlang to test for that and switch ldap instance as required. Ivan Kalik Kalik Informatika ISP
tnt@kalik.net wrote:
Make another ldap instance that has that basedn. Machine usernames have $ at the end - use unlang to test for that and switch ldap instance as required.
I see how to create another instance but really don't see where and how to use unlang to switch between the 2 instances depending on the username. Any clue ? Thanks
Make another ldap instance that has that basedn. Machine usernames have $ at the end - use unlang to test for that and switch ldap instance as required.
I see how to create another instance but really don't see where and how to use unlang to switch between the 2 instances depending on the username.
Any clue ?
regex. Ivan Kalik Kalik Informatika ISP
if(User-Name =~ /\$$/ ) { ldapmachine } else { ldapuser } Ivan Kalik Kalik Informatika ISP Dana 5/2/2009, "Laurent CARON" <lcaron@lncsa.com> piše:
tnt@kalik.net wrote:
regex.
Thanks Ivan,
Can you please give me some hint about what to put in config's stanzas ?
Thanks - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
tnt@kalik.net wrote:
if(User-Name =~ /\$$/ ) { ldapmachine } else { ldapuser }
in my radiusd.conf file I've got 2 stanzas like this: ldap { server = "...." port = "...." } ldap2 { server = "...." port = "...." } I did copy/paste the lines you gave me just over the first server = "..." line but it doesn't seem to do anything. Any clue ? Thanks
in my radiusd.conf file I've got 2 stanzas like this:
ldap { server = "...." port = "...." }
ldap2 { server = "...." port = "...." }
I did copy/paste the lines you gave me just over the first server = "..." line but it doesn't seem to do anything.
Any clue ?
That should be: ldap ldap1 { .. } ldap ldap2 { .. } What i wrote should go in the authorize section instead of ldap entry. Ivan Kalik Kalik Informatika ISP Ivan Kalik Kalik Informatika ISP
Hello, This is my users file. It works. But I have the impression that this could be optimized. Any suggestions? DEFAULT Auth-Type = opendirectory Fall-Through = 1 DEFAULT Ldap-Group == "wlan_test", Airespace-Wlan-Id == 4 Auth-Type := opendirectory, Service-Type = Login-User, Reply-Message = "wlan_test: WLAN-44 accept", Fall-Through = 1 DEFAULT Ldap-Group == "vpn_users" Auth-Type := opendirectory, Service-Type = Login-User, Reply-Message = "VPN-User: accepted", Fall-Through = 1 DEFAULT Ldap-Group != "all_wlan", NAS-IP-Address == 192.168.3.20, Auth- Type := Reject Reply-Message = "No all_wlan user: tc-29 rejected!!!", DEFAULT Ldap-Group == "employees" Auth-Type := opendirectory, Service-Type = Login-User, Reply-Message = "employees: accepted", Fall-Through = 1 DEFAULT Ldap-Group == "teacher", Airespace-Wlan-Id == 3 Auth-Type := opendirectory, Service-Type = Login-User, Reply-Message = "Lehrer: WLAN-44 accept", Fall-Through = 1 DEFAULT Ldap-Group == "teacher", Airespace-Wlan-Id == 4 Auth-Type := opendirectory, Service-Type = Login-User, Reply-Message = "Lehrer: WLAN-45 accept", Fall-Through = 1 DEFAULT Ldap-Group == "pupil", Airespace-Wlan-Id == 4 Auth-Type := opendirectory, Reply-Message = "Schueler: WLAN-45 accept", Fall-Through = 1 DEFAULT Ldap-Group == "pupil", Airespace-Wlan-Id != 4, Auth-Type := Reject Reply-Message = "Schueler: Wrong WLAN!!!", DEFAULT Ldap-Group == "schooladministration", Airespace-Wlan-Id == 6 Auth-Type := opendirectory, Service-Type = Login-User, Reply-Message = "schooladministration: WLAN-47 accept", Fall-Through = 1 DEFAULT Service-Type == Framed-User Framed-IP-Address = 255.255.255.254, Framed-MTU = 576, Service-Type = Framed-User, Fall-Through = Yes DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Hint == "CSLIP" Framed-Protocol = SLIP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Hint == "SLIP" Framed-Protocol = SLIP Thanks for your help Qrt
Hello, This is my users file. It works. But I have the impression that this could be optimized. Any suggestions? DEFAULT Auth-Type = opendirectory Fall-Through = 1 DEFAULT Ldap-Group == "wlan_test", Airespace-Wlan-Id == 4 Auth-Type := opendirectory, Service-Type = Login-User, Reply-Message = "wlan_test: WLAN-44 accept", Fall-Through = 1 DEFAULT Ldap-Group == "vpn_users" Auth-Type := opendirectory, Service-Type = Login-User, Reply-Message = "VPN-User: accepted", Fall-Through = 1 DEFAULT Ldap-Group != "all_wlan", NAS-IP-Address == 192.168.3.20, Auth- Type := Reject Reply-Message = "No all_wlan user: tc-29 rejected!!!", DEFAULT Ldap-Group == "employees" Auth-Type := opendirectory, Service-Type = Login-User, Reply-Message = "employees: accepted", Fall-Through = 1 DEFAULT Ldap-Group == "teacher", Airespace-Wlan-Id == 3 Auth-Type := opendirectory, Service-Type = Login-User, Reply-Message = "Lehrer: WLAN-44 accept", Fall-Through = 1 DEFAULT Ldap-Group == "teacher", Airespace-Wlan-Id == 4 Auth-Type := opendirectory, Service-Type = Login-User, Reply-Message = "Lehrer: WLAN-45 accept", Fall-Through = 1 DEFAULT Ldap-Group == "pupil", Airespace-Wlan-Id == 4 Auth-Type := opendirectory, Reply-Message = "Schueler: WLAN-45 accept", Fall-Through = 1 DEFAULT Ldap-Group == "pupil", Airespace-Wlan-Id != 4, Auth-Type := Reject Reply-Message = "Schueler: Wrong WLAN!!!", DEFAULT Ldap-Group == "schooladministration", Airespace-Wlan-Id == 6 Auth-Type := opendirectory, Service-Type = Login-User, Reply-Message = "schooladministration: WLAN-47 accept", Fall-Through = 1 DEFAULT Service-Type == Framed-User Framed-IP-Address = 255.255.255.254, Framed-MTU = 576, Service-Type = Framed-User, Fall-Through = Yes DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Hint == "CSLIP" Framed-Protocol = SLIP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Hint == "SLIP" Framed-Protocol = SLIP Thanks for your help Qrt
participants (3)
-
Laurent CARON -
qrt -
tnt＠kalik.net