FREERADIUS WITH MULTIPLE LDAP AUTHENTICATION SOURCES
Hi all, I am trying to set up a single freeradius with multiple ldap servers to query. The goal is to have a single freeradius server authenticating users from different tenants. Ex: user@domain1.com must use only the ldap domain1 {} configuration user@domain2.com must use only the ldap domain2 {} configuration I configured the file /etc/freeradius/3.0/mods-available/ldap in order to have the 2 configurations ldap domain1 {} and ldap domain2 {} and the bind is correct The problem is that when I run a radtest the user is searched for both on domain1 and on domain2 and then the result is returned only for domain2 because it is the last one that is queried. I would like that if I make a query, domain1 or domain2 is used based on the suffix of the user I am querying I hope I was clear Thanks for your help Diego INFORMATIVA PRIVACY (Reg.UE 2016/679 e D.Lgs.196/2003) Questa email ed i suoi eventuali allegati sono da considerarsi materiale riservato e di proprietà della scrivente società. Nel caso venisse ricevuta per errore non deve essere divulgata, copiata o distribuita per alcuna ragione. Le comunicazioni che transitano attraverso il presente indirizzo di posta elettronica hanno carattere e finalità prettamente lavorative, pertanto potranno essere conosciute all’interno dell’organizzazione aziendale. Qualsiasi dato personale sarà comunque trattato in conformità alle vigenti normative in materia di privacy e protezione dei dati personali. A tale riguardo potete esercitare tutti i diritti previsti dalla legge semplicemente rispondendo alla presente ed esplicitando la vostra richiesta. Maggiori info in materia di privacy: https://www.c2group.it/policy-privacy
On Nov 30, 2021, at 6:25 AM, Diego Forcella <diego.forcella@c2group.it> wrote:
I am trying to set up a single freeradius with multiple ldap servers to query. The goal is to have a single freeradius server authenticating users from different tenants.
Ex: user@domain1.com must use only the ldap domain1 {} configuration user@domain2.com must use only the ldap domain2 {} configuration
I configured the file /etc/freeradius/3.0/mods-available/ldap in order to have the 2 configurations ldap domain1 {} and ldap domain2 {} and the bind is correct
That's good.
The problem is that when I run a radtest the user is searched for both on domain1 and on domain2 and then the result is returned only for domain2 because it is the last one that is queried.
Because you listed both modules in the authorization section as: authorize { ... domain1 domain2 ... } The server doesn't know that the "domain1" module is for domain1.com. You have to tell it.
I would like that if I make a query, domain1 or domain2 is used based on the suffix of the user I am querying
$ man unlang You can do regular expression matches on the User-Name: if (User-Name =~ /@domain1.com/) { domain1 } elsif (User-Name =~ /@domain2.com/) { domain2 } Alan DeKok.
participants (2)
-
Alan DeKok -
Diego Forcella