dot1x with samba workstation accounts
Hello, I'm trying to authenticate my windows boxes with dot1x against freeradius. Everything is working fine if I'm using a normal user. But I want to use the samba workstation accounts from ldap. The problem: mschap blocks accounts which have only the W-sambaAcctFlag set:
info: [mschap] SMB-Account-Ctrl says that the account is disabled, or is not a normal account.
Shouldn't it be possible to use workstation accounts? My temporary solution is to exclude querying sambaAcctFlag. No real solution if you want to lock out really expired or disabled accounts :( -- Jens Weibler
Jens Weibler wrote:
I'm trying to authenticate my windows boxes with dot1x against freeradius. Everything is working fine if I'm using a normal user.
But I want to use the samba workstation accounts from ldap. The problem: mschap blocks accounts which have only the W-sambaAcctFlag set:
info: [mschap] SMB-Account-Ctrl says that the account is disabled, or is not a normal account.
Yes...
Shouldn't it be possible to use workstation accounts? My temporary solution is to exclude querying sambaAcctFlag. No real solution if you want to lock out really expired or disabled accounts :(
<shrug> If the flag means "disabled OR non-normal", then you can't have it both ways. If you want to allow non-normal accounts, you have to ignore the flag. If you want to disable users, you have to look at the flag. The two situations aren't compatible. You could always put disabled users into a "disabled" group, and check that. Alan DeKok.
On 17.06.2010 08:08, Alan DeKok wrote:
Jens Weibler wrote:
Shouldn't it be possible to use workstation accounts? My temporary solution is to exclude querying sambaAcctFlag. No real solution if you want to lock out really expired or disabled accounts :(
<shrug> If the flag means "disabled OR non-normal", then you can't have it both ways. If you want to allow non-normal accounts, you have to ignore the flag. If you want to disable users, you have to look at the flag. The two situations aren't compatible.
You could always put disabled users into a "disabled" group, and check that.
The question is: why isn't the check allowing workstations? if (((smb_ctrl->vp_integer & ACB_DISABLED) != 0) || (((smb_ctrl->vp_integer & ACB_NORMAL) == 0) && (smb_ctrl->vp_integer & ACB_WSTRUST == 0))) { RDEBUG2("SMB-Account-Ctrl says that the account is disabled, or is not a normal account."); -- Jens Weibler
Jens Weibler wrote:
The question is: why isn't the check allowing workstations?
if (((smb_ctrl->vp_integer & ACB_DISABLED) != 0) || (((smb_ctrl->vp_integer & ACB_NORMAL) == 0) && (smb_ctrl->vp_integer & ACB_WSTRUST == 0))) { RDEBUG2("SMB-Account-Ctrl says that the account is disabled, or is not a normal account.");
Hmm... The workstation accounts work when using Active Directory. Others have gotten it to work with Samba. I'm not sure what's different about your setup. Alan DeKok.
On 17.06.2010 16:56, Alan DeKok wrote:
Jens Weibler wrote:
The question is: why isn't the check allowing workstations?
if (((smb_ctrl->vp_integer & ACB_DISABLED) != 0) || (((smb_ctrl->vp_integer & ACB_NORMAL) == 0) && (smb_ctrl->vp_integer & ACB_WSTRUST == 0))) { RDEBUG2("SMB-Account-Ctrl says that the account is disabled, or is not a normal account.");
Hmm... The workstation accounts work when using Active Directory. Others have gotten it to work with Samba. I'm not sure what's different about your setup.
Maybe the others don't have changed the ldap.attrmap: - checkItem SMB-Account-CTRL-TEXT acctFlags +checkItem SMB-Account-CTRL-TEXT sambaAcctFlags Has someone a working samba-freeradius-ldap-workstationauthentication setup? -- Jens Weibler
participants (2)
-
Alan DeKok -
Jens Weibler