Setting up multiple NULL realms
I am trying to collapse multiple domains into one RADIUS server (version 2-2.1.12-4.el5_8)with and LDAP backend. I have everything that has a realm suffix working I.E. username@domain-name, RADIUS will strip the username query the LDAP server (each domain has its own OU)and life is good. The problem I am running into is this. Each of the domains that I am collapsing had multiple users that would just connect with "username". I can setup the NULL realm but I have only been successful in getting it to work for one of my domains (domain-1.com), all others (I.E. domain-2.com, domain-3.com) will get a password reject error as it queries against that virtual server and subsequent OU, I have tried to setup multiple virtual servers in the realm NULL setup but that doesn't work. I have looked in the mailing list archives and searched the net but I have not been able to find anything related to this. Proxy.conf setup realm NULL { virtual_server = virtual.domain-1.com virtual_server = virtual.domain-1.com } Users file setup DEFAULT Realm == "NULL", Service-Type == Framed-User, Huntgroup-Name == bras Filter-Id = "NoRealm", Fall-Through = Yes What way should I be going about this? Thanks, Chris
Chris Taylor wrote:
The problem I am running into is this. Each of the domains that I am collapsing had multiple users that would just connect with “username”.
Go fix that. Doing ANYTHING else means you have hacks on top of hacks, and an unmaintainable system.
I can setup the NULL realm but I have only been successful in getting it to work for one of my domains (domain-1.com), all others (I.E. domain-2.com, domain-3.com) will get a password reject error as it queries against that virtual server and subsequent OU, I have tried to setup multiple virtual servers in the realm NULL setup but that doesn’t work. I have looked in the mailing list archives and searched the net but I have not been able to find anything related to this.
Because this isn't a realm issue.
What way should I be going about this?
Get the users to log in with user@domain.tld Until then, create a global map of all usernames, and which domains they belong to. Many usernames will be unique. Those can have the realm added, so that they work. For non-unique ones, there's really nothing you can do but change what the users are entering. Alan DeKok.
participants (2)
-
Alan DeKok -
Chris Taylor