FR 3.x | rlm_ldap | bind as user?
Hello list, With FR 2.2.0 (fedora 18), my users are authenticated using "bind as user" from rlm_ldap (EAP/TTLS-PAP). However, i am not able to have the same behaviour with FR 3.0.1 (fedora 20). I didn't copy my old ldap configuration from 2.2 to 3.0, but created a new one from the sample file. Is it still possible to authenticate with ldap "bind as user" in FR 3.0? Or do i need to provide an admin account to rlm_ldap for browsing into the ldap database? Cheers, Erwann
On 13 Feb 2014, at 15:45, Erwann Thoraval <erwann.thoraval@mines-paristech.fr> wrote:
Hello list,
With FR 2.2.0 (fedora 18), my users are authenticated using "bind as user" from rlm_ldap (EAP/TTLS-PAP).
However, i am not able to have the same behaviour with FR 3.0.1 (fedora 20). I didn't copy my old ldap configuration from 2.2 to 3.0, but created a new one from the sample file.
Is it still possible to authenticate with ldap "bind as user" in FR 3.0? Or do i need to provide an admin account to rlm_ldap for browsing into the ldap database?
Yep, but you need to set the auth method manually. authorize { ldap if (ok && User-Password) { update control { Auth-Type := ldap } } } authenticate { Auth-Type ldap { ldap } } There's no toggle for doing this from within the LDAP module anymore. Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
On 13 Feb 2014, at 16:26, Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:
On 13 Feb 2014, at 15:45, Erwann Thoraval <erwann.thoraval@mines-paristech.fr> wrote:
Hello list,
With FR 2.2.0 (fedora 18), my users are authenticated using "bind as user" from rlm_ldap (EAP/TTLS-PAP).
However, i am not able to have the same behaviour with FR 3.0.1 (fedora 20). I didn't copy my old ldap configuration from 2.2 to 3.0, but created a new one from the sample file.
Is it still possible to authenticate with ldap "bind as user" in FR 3.0? Or do i need to provide an admin account to rlm_ldap for browsing into the ldap database?
Yep, but you need to set the auth method manually.
authorize { ldap if (ok && User-Password) {
sorry. if ((ok || updated) && User-Password) { } Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
Hi Arran, Thank you for your answer. On 13/02/2014 17:28, Arran Cudbard-Bell wrote:
Is it still possible to authenticate with ldap "bind as user" in FR 3.0? Or do i need to provide an admin account to rlm_ldap for browsing into the ldap database?
Yep, but you need to set the auth method manually.
Yes, it does work this way, thank you. I didn't find any information about this new rlm_ldap behaviour in the config file. Moreover, in FR 3.0.1, doc/modules/rlm_ldap file is missing. Will this "bind as user" feature will disappear soon or less? Regards, -- Erwann
On 19 Feb 2014, at 10:24, Erwann Thoraval <erwann.thoraval@mines-paristech.fr> wrote:
Hi Arran,
Thank you for your answer.
On 13/02/2014 17:28, Arran Cudbard-Bell wrote:
Is it still possible to authenticate with ldap "bind as user" in FR 3.0? Or do i need to provide an admin account to rlm_ldap for browsing into the ldap database?
Yep, but you need to set the auth method manually.
Yes, it does work this way, thank you.
I didn't find any information about this new rlm_ldap behaviour in the config file. Moreover, in FR 3.0.1, doc/modules/rlm_ldap file is missing.
Can't be missing if it was never written :)
Will this "bind as user" feature will disappear soon or less?
No. Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
On 19/02/2014 11:37, Arran Cudbard-Bell wrote:
I didn't find any information about this new rlm_ldap behaviour in the config file. Moreover, in FR 3.0.1, doc/modules/rlm_ldap file is missing.
Can't be missing if it was never written :)
Indeed :) Sorry, it wasn't clear. In FR 2.2.3, there is a doc/rlm_ldap file which i can't find in FR 3.0.1. This rlm_ldap documentation could be useful and may incorpore the piece of code you posted on 2/13, couldn't be? Regards, -- Erwann
On 19 Feb 2014, at 11:22, Erwann Thoraval <erwann.thoraval@mines-paristech.fr> wrote:
On 19/02/2014 11:37, Arran Cudbard-Bell wrote:
I didn't find any information about this new rlm_ldap behaviour in the config file. Moreover, in FR 3.0.1, doc/modules/rlm_ldap file is missing.
Can't be missing if it was never written :)
Indeed :) Sorry, it wasn't clear. In FR 2.2.3, there is a doc/rlm_ldap file which i can't find in FR 3.0.1.
This rlm_ldap documentation could be useful and may incorpore the piece of code you posted on 2/13, couldn't be?
The configuration file for LDAP is very well documented, I don't think there's any need for separate documentation. But i've added a note for set_auth_type. Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
participants (2)
-
Arran Cudbard-Bell -
Erwann Thoraval