Multiple LDAP Configurations on a single freeradius daemon
Hi, I'm looking for the best way of configuring freeradius (either version 1.1.3 or version 2.1.1) with two separate LDAP configurations. The reason for this, is we've got two different NAS' (VPN client and WIFI) both querying freeradius with LDAP backend for authentication and authorization, but we want to be able to control access to both services with an ldap "accessTo" attribute: ldap { server = "10.0.0.2" identity = "uid=radiusadmin,ou=system,dc=test,dc=com" password = "radiustest" basedn = "dc=test,dc=com" filter="(&(|(accessTo=WIFI_FR)(accessTo=WIFI_ALL))(uid=%{Stripped-User-Name:-%{User-Name}}))" base_filter = "(objectclass=radiusprofile)" ... Anybody got any suggestions on how to have two ldap configurations (two different filters) and have those assigned to a NAS/Client? Thanks in advance, Nils
Yes, but will that allow me to choose an ldap configuration per NAS in clients.conf? If I list both of these in the authorize block, won't that return a successful result for both NAS if either one of the filters matches? Thx. Nils tnt@kalik.net wrote:
I'm looking for the best way of configuring freeradius (either version 1.1.3 or version 2.1.1) with two separate LDAP configurations.
Create multiple ldap instances:
ldap wifi { .. }
ldap vpn { .. }
That works for any module.
Ivan Kalik Kalik Informatika ISP
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Yes, but will that allow me to choose an ldap configuration per NAS in clients.conf?
If I list both of these in the authorize block, won't that return a successful result for both NAS if either one of the filters matches?
It would. So use unlang to choose which ldap instance will be used for which NAS-IP-Address. Ivan Kalik Kalik Informatika ISP
participants (2)
-
Nils Cant -
tnt＠kalik.net