Checking for disabled ad account
Hi I’ve configured EAP-TLS with ocsp validation in FR 3.0.16 I’ve now been told that I need to also check that the username associated with the account hasn’t been disabled in our AD service. Same FR server also does EAP-PEAP auth against AD Any suggestions as to how I might do this ? Rgds Alex Sent from my iPhone 6 plus
On Oct 25, 2017, at 1:19 PM, Alex Sharaz <alex.sharaz@york.ac.uk> wrote:
I’ve configured EAP-TLS with ocsp validation in FR 3.0.16 I’ve now been told that I need to also check that the username associated with the account hasn’t been disabled in our AD service.
Same FR server also does EAP-PEAP auth against AD
Any suggestions as to how I might do this ?
Configure the LDAP module, and do an LDAP query. Alan DeKok.
You can use a bitwise filter in LDAP to test if an account is disabled. See https://support.microsoft.com/en-us/help/269181/how-to-query-active-director... Regards Max -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+max.caines=wlv.ac.uk@lists.freeradius.org] On Behalf Of Alan DeKok Sent: 25 October 2017 19:01 To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: Checking for disabled ad account On Oct 25, 2017, at 1:19 PM, Alex Sharaz <alex.sharaz@york.ac.uk> wrote:
I’ve configured EAP-TLS with ocsp validation in FR 3.0.16 I’ve now been told that I need to also check that the username associated with the account hasn’t been disabled in our AD service.
Same FR server also does EAP-PEAP auth against AD
Any suggestions as to how I might do this ?
Configure the LDAP module, and do an LDAP query. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Cool! Many thanks Alex Sent from my iPhone 6 plus
On 26 Oct 2017, at 12:19, Caines, Max <Max.Caines@wlv.ac.uk> wrote:
You can use a bitwise filter in LDAP to test if an account is disabled. See https://support.microsoft.com/en-us/help/269181/how-to-query-active-director...
Regards
Max
-----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+max.caines=wlv.ac.uk@lists.freeradius.org] On Behalf Of Alan DeKok Sent: 25 October 2017 19:01 To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: Checking for disabled ad account
On Oct 25, 2017, at 1:19 PM, Alex Sharaz <alex.sharaz@york.ac.uk> wrote: I’ve configured EAP-TLS with ocsp validation in FR 3.0.16 I’ve now been told that I need to also check that the username associated with the account hasn’t been disabled in our AD service.
Same FR server also does EAP-PEAP auth against AD
Any suggestions as to how I might do this ?
Configure the LDAP module, and do an LDAP query.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (3)
-
Alan DeKok -
Alex Sharaz -
Caines, Max