Hello All Doing a little research. We have a customer that has 5 different Windows Active Directory domains (separate companies) all using their own IP address ranges. What they want to achieve, irrespective on where the users physically reside is for the radius server to identify the user from their login details and then issue out the correct IP address for that company. Has anyone done anything like this using FreeRadius? Regards Brian Smith IN 2 IT Tel: +27 11 453 9136 Fax: +27 11 453 1788 Connect with me on Facebook <https://www.facebook.com/BrianSmithIN2IT> https://www.facebook.com/BrianSmithIN2IT <http://www.in2it.co.za/> in2itlogo <http://www.facebook.com/pages/in2itcoza/146008768784049> facebook <https://www.linkedin.com/company/in2it-> linkedin PLEASE NOTE: For Technical queries, log your request via the IN2IT Ticket system. This may be found on <http://www.in2it.co.za> www.in2it.co.za under the Log Support option. This is the preferred system for support for reasons of transparency. Whatsapp, email and SMS requests do not guarentee immediate action. Tickets may be created telephonically, please phone should the above system not be available.
On Oct 26, 2017, at 9:51 AM, Brian Smith - IN2IT <bsmith@in2it.co.za> wrote:
Doing a little research. We have a customer that has 5 different Windows Active Directory domains (separate companies) all using their own IP address ranges. What they want to achieve, irrespective on where the users physically reside is for the radius server to identify the user from their login details
How does the RADIUS server identify the user from their login details?
and then issue out the correct IP address for that company.
Issue the IP address... how? Via RADIUS? DHCP?
Has anyone done anything like this using FreeRadius?
More details would be useful. If you just want to assign IPs in RADIUS from an LDAP query, then it's pretty simple to do. Just configure AD as an LDAP server, and then write the LDAP queries. The short answer is that FreeRADIUS can do pretty much anything. But you can't configure it to do anything until you (a) know what you have, and (b) know what you want. Alan DeKok.
On 26 Oct 2017, at 14:51, Brian Smith - IN2IT <bsmith@in2it.co.za> wrote:
Has anyone done anything like this using FreeRadius?
Most of the problems aren't FreeRADIUS problems - FreeRADIUS can certainly do what you've described, but it is dependant on you being able to supply it useful information: * Identifying users - how do you tell Company A's users from Company B's users? Do they have different @realms? Different DOMAIN\ ? * The above will influence your backend - if you use Samba (for machine authentication), getting it to authenticate multiple domains is hard/impossible, so you'd likely need at least 1 server per domain, fronted by additional RADIUS servers to route the requests. If you use LDAP directly you could use a single instance, but integrating with AD using raw LDAP has some challenges. You could also try adding a 6th domain with trusts to each of the 5 domains. EAP type used has a large impact here - if you use EAP-TLS with user certificates, you may not even need to communicate with the domains. * What policy do you need to implement? Should Company A be able to log on from access points at company B? Do you need to classify users into groups? * How will the addresses be assigned? Using RADIUS, or dynamic VLAN assignment and DHCP? It's likely that unless your environment does something very specialised or non-standard, you can make everything work, but you need to provide more information before anyone can tell you what configuration to use. Regards, Adam Bishop gpg: E75B 1F92 6407 DFDF 9F1C BF10 C993 2504 6609 D460 jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 2881024, VAT number GB 197 0632 86. The registered office is: One Castle Park, Tower Hill, Bristol BS2 0JA. T 0203 697 5800.
participants (3)
-
Adam Bishop -
Alan DeKok -
Brian Smith - IN2IT