hi all, I have setup a FreeRadius server which is authenticating against an OpenLDAP database. It's all working very nicely and I have it setup with radius attributes being stored inside the LDAP database for each user. However, what would be nice, would be to have the ability to store radius attributes against groups that the user belongs to, so that when radius queries the user, it gets all the attributes for all the groups that the user belongs to. I've had a look through the rlm_ldap documentation which has some configuration options for groups, however it seems to me that this is for authenticating users based on which group they are in, rather than being able to fetch attributes from the groups that the user belongs to? Is this understanding correct, or am I missing something? thanks in advance for any help! :-) FreeRadius version is 1.1.3 (RHEL 5 build) if that's important. regards, jethro -- Jethro Carr www.jethrocarr.com/index.php?cms=blog www.amberdms.com
On 03/01/2010 03:55 PM, Jethro Carr wrote:
hi all,
I have setup a FreeRadius server which is authenticating against an OpenLDAP database.
It's all working very nicely and I have it setup with radius attributes being stored inside the LDAP database for each user.
However, what would be nice, would be to have the ability to store radius attributes against groups that the user belongs to, so that when radius queries the user, it gets all the attributes for all the groups that the user belongs to.
I've had a look through the rlm_ldap documentation which has some configuration options for groups, however it seems to me that this is for authenticating users based on which group they are in, rather than being able to fetch attributes from the groups that the user belongs to?
Is this understanding correct, or am I missing something?
If I understand correctly what you would like to do then check out "profiles" in the ldap_howto.txt. A profile is a way to associate a set of attributes (e.g. the profile) with a user.
thanks in advance for any help! :-)
FreeRadius version is 1.1.3 (RHEL 5 build) if that's important.
BTW, you can find a current 2.1.8 build for RHEL 5 by visiting http://wiki.freeradius.org/RedHat_FAQ -- John Dennis <jdennis@redhat.com> Looking to carve out IT costs? www.redhat.com/carveoutcosts/
On Mon, 2010-03-01 at 17:42 -0500, John Dennis wrote:
If I understand correctly what you would like to do then check out "profiles" in the ldap_howto.txt. A profile is a way to associate a set of attributes (e.g. the profile) with a user.
thanks John, Robert and off-listers, Looking at the ldap_howto.txt file and the responses I've had it seems that I need to: 1. Define groups/profiles in LDAP 2. Set attributes for the users stating which groups they belong to, eg using the radiusGroupName LDAP attribute. 3. Map the groups to NASes using huntgroups or users file. Going to give it a try and will post back with how I get on. Thanks for the help guys. :-)
thanks in advance for any help! :-)
FreeRadius version is 1.1.3 (RHEL 5 build) if that's important.
BTW, you can find a current 2.1.8 build for RHEL 5 by visiting http://wiki.freeradius.org/RedHat_FAQ
Thanks, but FYI, that page is blank. regards, jethro -- Jethro Carr www.jethrocarr.com/index.php?cms=blog www.amberdms.com
Jethro The eaist way is as per what I e-mailed to you. http://lists.freeradius.org/mailman/htdig/freeradius-users/2009-November/msg... This means you only need to create groups in your LDAP directory. It also means you don't need to extend the LDAP Schema to do this. And use the Postauth_users & Host Groups file to determine which server you are allowed to login from. I have yet to find a better or easier way to do things. Thanks Peter On Thu, Mar 4, 2010 at 5:19 PM, Jethro Carr <jethro.carr@jethrocarr.com>wrote:
On Mon, 2010-03-01 at 17:42 -0500, John Dennis wrote:
If I understand correctly what you would like to do then check out "profiles" in the ldap_howto.txt. A profile is a way to associate a set of attributes (e.g. the profile) with a user.
thanks John, Robert and off-listers,
Looking at the ldap_howto.txt file and the responses I've had it seems that I need to:
1. Define groups/profiles in LDAP
2. Set attributes for the users stating which groups they belong to, eg using the radiusGroupName LDAP attribute.
3. Map the groups to NASes using huntgroups or users file.
Going to give it a try and will post back with how I get on. Thanks for the help guys. :-)
thanks in advance for any help! :-)
FreeRadius version is 1.1.3 (RHEL 5 build) if that's important.
BTW, you can find a current 2.1.8 build for RHEL 5 by visiting http://wiki.freeradius.org/RedHat_FAQ
Thanks, but FYI, that page is blank.
regards, jethro
-- Jethro Carr www.jethrocarr.com/index.php?cms=blog www.amberdms.com
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Thu, 2010-03-04 at 17:28 +1300, Peter Lambrechtsen wrote:
Jethro
The eaist way is as per what I e-mailed to you.
http://lists.freeradius.org/mailman/htdig/freeradius-users/2009-November/msg...
This means you only need to create groups in your LDAP directory. It also means you don't need to extend the LDAP Schema to do this.
And use the Postauth_users & Host Groups file to determine which server you are allowed to login from.
I have yet to find a better or easier way to do things.
Many thanks to Peter as well as John, Robert and others who replied. The solution at the URL above worked well for me and my FreeRadius deployment is able to fetch radius attributes from both the user or the group the user belongs to. Thanks for the help guys! :-) regards, jethro -- Jethro Carr www.jethrocarr.com/index.php?cms=blog www.amberdms.com
participants (3)
-
Jethro Carr -
John Dennis -
Peter Lambrechtsen