Hi, I am doing a setup has the following criteria. I have setup as per instruction from freeradius wiki but stuck with the Dynamic VLAN part. May I know where can I get further information on Authorization for VLAN setup? Thank you for helping. https://wiki.freeradius.org/guide/Active-Directory-direct-via-winbind Existing Setup 1) Windows 2012R2 Acitive Directory Server Proposed Setup 1) Unifi AP-Lite with Unifi Controller 5.2.9, FreeRadius 3.0.11, Samba 4.3 2) WAP-Enterprise with PEAP-MSCHAPv2 3) Dynamic VLAN Assignment by user group
On 11-11-16 13:07, Albert K wrote:
Hi,
I am doing a setup has the following criteria. I have setup as per instruction from freeradius wiki but stuck with the Dynamic VLAN part. May I know where can I get further information on Authorization for VLAN setup? Thank you for helping.
https://wiki.freeradius.org/guide/Active-Directory-direct-via-winbind
That page doesn't (and shouldn't) have a Dynamic VLAN part. Release 3.0.x can only use winbind to do the authentication: pass a username and a password-hash-thingy to Active Directory and ask if this combination is correct. Release 3.1.x/4.0.x add possibilities to find the groups of the user (I believe, it might be possible this was only proposed but not yet added). You can still use the LDAP-protocol to search for the groups of a user to base the VLAN on that, but that is not related to the winbind authentication process. -- Herwin Weststrate
On Fri, Nov 11, 2016 at 01:15:33PM +0100, Herwin Weststrate wrote:
On 11-11-16 13:07, Albert K wrote:
I am doing a setup has the following criteria. I have setup as per instruction from freeradius wiki but stuck with the Dynamic VLAN part. May I know where can I get further information on Authorization for VLAN setup? Thank you for helping.
https://wiki.freeradius.org/guide/Active-Directory-direct-via-winbind
That page doesn't (and shouldn't) have a Dynamic VLAN part.
Release 3.0.x can only use winbind to do the authentication: pass a username and a password-hash-thingy to Active Directory and ask if this combination is correct.
3.0.x can do MSCHAPv2 direct to winbindd with the rlm_mschap module. 3.1.x/4.0.x (dev versions) can do PAP direct to winbindd with the rlm_winbind module.
Release 3.1.x/4.0.x add possibilities to find the groups of the user (I believe, it might be possible this was only proposed but not yet added).
rlm_winbind in 3.1.x can search groups. Though from a discussion on the Samba mailing list the other day it turns out this isn't as reliable and/or simple as expected, so the functionality might have to change or go away. To be safe only use it after a successful authentication.
You can still use the LDAP-protocol to search for the groups of a user to base the VLAN on that, but that is not related to the winbind authentication process.
That is still the recommended way, and the only way in 3.0. Matthew -- Matthew Newton, Ph.D. <mcn4@leicester.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
Hi,
Hi,
I am doing a setup has the following criteria. I have setup as per instruction from freeradius wiki but stuck with the Dynamic VLAN part. May I know where can I get further information on Authorization for VLAN setup? Thank you for helping.
read the docs, configure the server as required.
https://wiki.freeradius.org/guide/Active-Directory-direct-via-winbind
Existing Setup 1) Windows 2012R2 Acitive Directory Server
Proposed Setup 1) Unifi AP-Lite with Unifi Controller 5.2.9, FreeRadius 3.0.11, Samba 4.3 2) WAP-Enterprise with PEAP-MSCHAPv2 3) Dynamic VLAN Assignment by user group
so...HOW are you determining group membership? from the AD? using LDAP ? if so, look at eg LDAP-Group info....use unlang to define your check and policy and return required thing. this can be done in SO many ways - it depends on how you want to engineer it. alan
Hi, Thank you for the prompt reply. From the answers that I am getting here, it seems that winbind by itself could not do the Authenticate and Authorize in one step. Thanks again for clearing up the issue. On Fri, Nov 11, 2016 at 10:01 PM, <A.L.M.Buxey@lboro.ac.uk> wrote:
Hi,
Hi,
I am doing a setup has the following criteria. I have setup as per instruction from freeradius wiki but stuck with the Dynamic VLAN part. May I know where can I get further information on Authorization for VLAN setup? Thank you for helping.
read the docs, configure the server as required.
https://wiki.freeradius.org/guide/Active-Directory-direct-via-winbind
Existing Setup 1) Windows 2012R2 Acitive Directory Server
Proposed Setup 1) Unifi AP-Lite with Unifi Controller 5.2.9, FreeRadius 3.0.11, Samba 4.3 2) WAP-Enterprise with PEAP-MSCHAPv2 3) Dynamic VLAN Assignment by user group
so...HOW are you determining group membership? from the AD? using LDAP ? if so, look at eg LDAP-Group info....use unlang to define your check and policy and return required thing. this can be done in SO many ways - it depends on how you want to engineer it.
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html
Hi, I am stuck with the Ldap module and need help. I can login with the user account ldapuser to the AD and the password is all correct. The error I get from starting radiusd -X (freeradius version 3.0.11) rlm_ldap (ldap): Connecting to ldap://ad.mycompany.com:50000 rlm_ldap (ldap):Waiting for bind result.... rlm_ldap (ldap):Bind credentials incorrect: Invalid credentials rlm_ldap (ldap):Server Said: 8009030C: LdapErr: DISD-0C0903C5, comment: AcceptSecurityContext Error data 2030, v2580 rlm_ldap (ldap):Opening connection failed (0) rlm_ldap (ldap): Removing connection pool raddb/mods-enabled/ldap ldap { server ='ad.mycompay.com' port = 50000 identity = 'cn=ldapuser,cn=users,dc=mycompany,dc=com' password = 12345678 base_dn = 'dc=mycompany.dc=com' ..... } } On Fri, Nov 11, 2016 at 10:10 PM, Albert K <alberk@gmail.com> wrote:
Hi,
Thank you for the prompt reply. From the answers that I am getting here, it seems that winbind by itself could not do the Authenticate and Authorize in one step. Thanks again for clearing up the issue.
On Fri, Nov 11, 2016 at 10:01 PM, <A.L.M.Buxey@lboro.ac.uk> wrote:
Hi,
Hi,
I am doing a setup has the following criteria. I have setup as per instruction from freeradius wiki but stuck with the Dynamic VLAN part. May I know where can I get further information on Authorization for VLAN setup? Thank you for helping.
read the docs, configure the server as required.
https://wiki.freeradius.org/guide/Active-Directory-direct-via-winbind
Existing Setup 1) Windows 2012R2 Acitive Directory Server
Proposed Setup 1) Unifi AP-Lite with Unifi Controller 5.2.9, FreeRadius 3.0.11, Samba 4.3 2) WAP-Enterprise with PEAP-MSCHAPv2 3) Dynamic VLAN Assignment by user group
so...HOW are you determining group membership? from the AD? using LDAP ? if so, look at eg LDAP-Group info....use unlang to define your check and policy and return required thing. this can be done in SO many ways - it depends on how you want to engineer it.
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list /users.html
On Thu, Nov 17, 2016 at 06:56:48PM +0800, Albert K wrote:
I am stuck with the Ldap module and need help. I can login with the user account ldapuser to the AD and the password is all correct.
The error I get from starting radiusd -X (freeradius version 3.0.11)
rlm_ldap (ldap): Connecting to ldap://ad.mycompany.com:50000
That's a weird port, but... OK.
rlm_ldap (ldap):Waiting for bind result.... rlm_ldap (ldap):Bind credentials incorrect: Invalid credentials
Seems simple enough. LDAP username or password is wrong.
rlm_ldap (ldap):Server Said: 8009030C: LdapErr: DISD-0C0903C5, comment: AcceptSecurityContext Error data 2030, v2580 rlm_ldap (ldap):Opening connection failed (0) rlm_ldap (ldap): Removing connection pool
server ='ad.mycompay.com' port = 50000 identity = 'cn=ldapuser,cn=users,dc=mycompany,dc=com' password = 12345678 base_dn = 'dc=mycompany.dc=com' .....
Do those credentials work when passed to the ldapsearch utility? It's AD; maybe identity = "ldapuser@mycompany.com"? Matthew -- Matthew Newton, Ph.D. <mcn4@leicester.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
Thanks Mathew, The error is now resolved. For Windows Active Directory LDAP the identity should be as below. identity = "ldapuser@mycompany.com" On Thu, Nov 17, 2016 at 7:49 PM, Matthew Newton <mcn4@leicester.ac.uk> wrote:
On Thu, Nov 17, 2016 at 06:56:48PM +0800, Albert K wrote:
I am stuck with the Ldap module and need help. I can login with the user account ldapuser to the AD and the password is all correct.
The error I get from starting radiusd -X (freeradius version 3.0.11)
rlm_ldap (ldap): Connecting to ldap://ad.mycompany.com:50000
That's a weird port, but... OK.
rlm_ldap (ldap):Waiting for bind result.... rlm_ldap (ldap):Bind credentials incorrect: Invalid credentials
Seems simple enough. LDAP username or password is wrong.
rlm_ldap (ldap):Server Said: 8009030C: LdapErr: DISD-0C0903C5, comment: AcceptSecurityContext Error data 2030, v2580 rlm_ldap (ldap):Opening connection failed (0) rlm_ldap (ldap): Removing connection pool
server ='ad.mycompay.com' port = 50000 identity = 'cn=ldapuser,cn=users,dc=mycompany,dc=com' password = 12345678 base_dn = 'dc=mycompany.dc=com' .....
Do those credentials work when passed to the ldapsearch utility?
It's AD; maybe identity = "ldapuser@mycompany.com"?
Matthew
-- Matthew Newton, Ph.D. <mcn4@leicester.ac.uk>
Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom
For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk> - List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html
participants (4)
-
A.L.M.Buxey＠lboro.ac.uk -
Albert K -
Herwin Weststrate -
Matthew Newton