Using Ntlm_auth from the samba server is not an option. I want to access the AD with the ldap protocol for compatibility reasons.
You can't.
Next, I want to place the logged on user is a specific VLAN. So I have to retrieve the user's vlan from the AD. Is there any way to configure freeradius to do so?
Yes, see the docs.
Can you please provide me with the necessary steps to accomplish this?
Ditto. josh. JANET(UK) is a trading name of The JNT Association, a company limited by guarantee which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Science and Innovation Campus, Didcot, Oxfordshire. OX11 0SG
If I have to contact the AD with the ldap protocol for the vlan, why can't I just use that way to verify the user's credentials? The use Ntlm must be configured in radiusd.conf, but how and were do I configure the ldap bind to get the users group and define the vlan? Rutger -----Original Message----- From: freeradius-users-bounces+sylvester_rutger=hotmail.com@lists.freeradius.org [mailto:freeradius-users-bounces+sylvester_rutger=hotmail.com@lists.freeradi us.org] On Behalf Of Josh Howlett Sent: Thursday, December 20, 2007 10:36 PM To: FreeRadius users mailing list Cc: Josh Howlett Subject: RE: freeradius and active directory
Using Ntlm_auth from the samba server is not an option. I want to access the AD with the ldap protocol for compatibility reasons.
You can't.
Next, I want to place the logged on user is a specific VLAN. So I have to retrieve the user's vlan from the AD. Is there any way to configure freeradius to do so?
Yes, see the docs.
Can you please provide me with the necessary steps to accomplish this?
Ditto. josh. JANET(UK) is a trading name of The JNT Association, a company limited by guarantee which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Science and Innovation Campus, Didcot, Oxfordshire. OX11 0SG - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Rutger Beyen wrote:
If I have to contact the AD with the ldap protocol for the vlan, why can't I just use that way to verify the user's credentials?
AD can verify credentials, if FreeRADIUS sees a clear-text password in the RADIUS request. Otherwise, it's impossible. AD is *not* an LDAP server, even though it appears to be one.
The use Ntlm must be configured in radiusd.conf, but how and were do I configure the ldap bind to get the users group and define the vlan?
You don't. You do LDAP queries. Alan DeKok.
Thanks!
You don't. You do LDAP queries.
So where do I specify them and how should a query look like ? Rutger -----Original Message----- From: freeradius-users-bounces+sylvester_rutger=hotmail.com@lists.freeradius.org [mailto:freeradius-users-bounces+sylvester_rutger=hotmail.com@lists.freeradi us.org] On Behalf Of Alan DeKok Sent: Sunday, December 23, 2007 1:03 AM To: FreeRadius users mailing list Subject: Re: freeradius and active directory Rutger Beyen wrote:
If I have to contact the AD with the ldap protocol for the vlan, why can't I just use that way to verify the user's credentials?
AD can verify credentials, if FreeRADIUS sees a clear-text password in the RADIUS request. Otherwise, it's impossible. AD is *not* an LDAP server, even though it appears to be one.
The use Ntlm must be configured in radiusd.conf, but how and were do I configure the ldap bind to get the users group and define the vlan?
You don't. You do LDAP queries. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Rutger Beyen wrote:
So where do I specify them and how should a query look like ?
For simple mapping of LDAP attributes to RADIUS, see 'ldap.attrmap'. For complex queries, see doc/variables.txt, and just put the LDAP queries into an dynamically expanded string: DEFAULT Reply-Message = "LDAP stuff is %{ldap: .... query ...}" Alan DeKok.
participants (3)
-
Alan DeKok -
Josh Howlett -
Rutger Beyen