How do I have one Freeradius server hosting multiple ldap instances and associate each SSID with particular LDAP instance to authenticate
Hi Freeradius user group, I am relatively new to using Freeradius. Thanks for all your help and patience in advance: I would like to have one Freeradius server hosting multiple ldap instances and associate each SSID with particular LDAP ou to authenticate. For example: 1) Marketing SSID associated with LDAP1 marketing_ldap instance pointing to i.e. OU=Marketing,o=US to authenticate using EAP-PEAP MSCHAPv2 2) Accounting SSID associated with LDAP2 accounting_ldap instance pointing to i.e. OU=Accouting,o=US to authenticate using EAP-PEAP MSCHAPv2 Ultimately, I would also need to do the following: 3) Secure SSID associated with multiple LDAPs.. If user is not found in 1st LDAP, it would look in 2nd LDAP followed by 3rd LDAP.. *How do I do items 1 & 2 (priority) above? Doing item #3 above is down the road. Please help.. I greatly appreciate your advice.. Thank you. I've been searching google for a couple of days and I'm stuck..* I already have the following configured on my FreeRADIUS Version 2.1.1 on SLES 11 SP1: *1) /etc/raddb/modules/ldap* with ldap marketing_ldap with accounting_ldap *2) /etc/raddb/sites-available/default & /etc/raddb/sites-available/inner-tunnel* Enable LDAP1 & LDAP2 in Authorize Section Authenticate Section Post-Auth Section *3) /etc/raddb/eap.conf* configured to use PEAP *4) /etc/raddb/modules/mschap* mschap settings *5) /etc/raddb/clients.conf* settings to Cisco WLAN AP Thank you, doreen
Hello All. Please help.. Any suggestions on where I should start? Thank you very much for your help!! Doreen On Mon, Sep 20, 2010 at 1:47 PM, Ziggy Bopster <ziggybopster@gmail.com>wrote:
Hi Freeradius user group,
I am relatively new to using Freeradius. Thanks for all your help and patience in advance:
I would like to have one Freeradius server hosting multiple ldap instances and associate each SSID with particular LDAP ou to authenticate. For example: 1) Marketing SSID associated with LDAP1 marketing_ldap instance pointing to i.e. OU=Marketing,o=US to authenticate using EAP-PEAP MSCHAPv2 2) Accounting SSID associated with LDAP2 accounting_ldap instance pointing to i.e. OU=Accouting,o=US to authenticate using EAP-PEAP MSCHAPv2
Ultimately, I would also need to do the following: 3) Secure SSID associated with multiple LDAPs.. If user is not found in 1st LDAP, it would look in 2nd LDAP followed by 3rd LDAP..
*How do I do items 1 & 2 (priority) above? Doing item #3 above is down the road. Please help.. I greatly appreciate your advice.. Thank you. I've been searching google for a couple of days and I'm stuck..*
I already have the following configured on my FreeRADIUS Version 2.1.1 on SLES 11 SP1: *1) /etc/raddb/modules/ldap* with ldap marketing_ldap with accounting_ldap
*2) /etc/raddb/sites-available/default & /etc/raddb/sites-available/inner-tunnel* Enable LDAP1 & LDAP2 in Authorize Section Authenticate Section Post-Auth Section
*3) /etc/raddb/eap.conf* configured to use PEAP
*4) /etc/raddb/modules/mschap* mschap settings
*5) /etc/raddb/clients.conf* settings to Cisco WLAN AP
Thank you, doreen
On 09/22/2010 09:58 PM, Ziggy Bopster wrote:
Hello All.
Please help.. Any suggestions on where I should start? Thank you very much for your help!!
You have two options: First, create >1 instance of the ldap module. Use conditional statements in the authorize section to do your ldap queries. For example: modules/my_ldap: ldap staff_ldap { ... ldap config } ldap other_ldap { ... ldap config } sites-available/... authorize { ... if (...) { staff_ldap } elsif (...) { other_ldap } ... } The other option - if only a small amount of config varies, the ldap module expands some of it's config. For example: modules/ldap: ldap { basedn = "ou=%{Tmp-String-0},ou=MyOrg,c=US" ... } sites-available/... authorize { if (...) { update request { Tmp-String-0 = "Staff" } } elsif (...) { update request { Tmp-String-0 = "..." } } } ...when the LDAP module is executed the basedn will be expanded dynamically and search based on what you've configured. Most of this is documented. Have you read the docs?
Hi Phil, Thank you so much for responding with your recommendations.. The Ldap config varies only by Server IP, Base DN and password.. If I use option #2, how does Free Radius know which OU to plug in when authorizing users? Does that mean users have to enter their fully qualified login name ? Maybe Option #1 is good if I check for Calling Station ID in the "if" statement in the authorize section? Thank you for your patience again with my questions.. I wasn't sure what to call what I am trying to do, so couldn't find exact documentation on it.. Do you have a link where I can find out more info on how to do this? THANK YOU SOOO MUCH. Doreen On Wed, Sep 22, 2010 at 3:50 PM, Phil Mayers <p.mayers@imperial.ac.uk>wrote:
On 09/22/2010 09:58 PM, Ziggy Bopster wrote:
Hello All.
Please help.. Any suggestions on where I should start? Thank you very much for your help!!
You have two options:
First, create >1 instance of the ldap module. Use conditional statements in the authorize section to do your ldap queries. For example:
modules/my_ldap:
ldap staff_ldap { ... ldap config }
ldap other_ldap { ... ldap config }
sites-available/...
authorize { ... if (...) { staff_ldap } elsif (...) { other_ldap } ... }
The other option - if only a small amount of config varies, the ldap module expands some of it's config. For example:
modules/ldap:
ldap { basedn = "ou=%{Tmp-String-0},ou=MyOrg,c=US" ... }
sites-available/...
authorize { if (...) { update request { Tmp-String-0 = "Staff" } } elsif (...) { update request { Tmp-String-0 = "..." } } }
...when the LDAP module is executed the basedn will be expanded dynamically and search based on what you've configured.
Most of this is documented. Have you read the docs? - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 23/09/10 15:08, Ziggy Bopster wrote:
Hi Phil,
Thank you so much for responding with your recommendations.. The Ldap config varies only by Server IP, Base DN and password.. If I use option
If the bind DN passwords are different, you probably can't use this option. You'll probably need >1 ldap module.
#2, how does Free Radius know which OU to plug in when authorizing users? Does that mean users have to enter their fully qualified login name ?
Have you read docs/rlm_ldap?
Maybe Option #1 is good if I check for Calling Station ID in the "if" statement in the authorize section?
Yes, I think that's your best option.
Thank you for your patience again with my questions.. I wasn't sure what to call what I am trying to do, so couldn't find exact documentation on it.. Do you have a link where I can find out more info on how to do this? THANK YOU SOOO MUCH.
FreeRadius basically passes each request through a series of modules. You can control the flow through these modules in various ways. See "man unlang" for the basic documentation.
Hi Phil, Let me look into the docs and see if I can get something setup.. If I had one SSID and wanted multiple LDAP servers & search bases behind it, should I use Option#1.. (i.e. User selects SSID Secure.. If user is not found in LDAP search base #1, look for user in LDAP search base #2, if not found in LDAP search base #3, look for it in #4 and etc.. Doreen On Thu, Sep 23, 2010 at 7:47 AM, Phil Mayers <p.mayers@imperial.ac.uk>wrote:
On 23/09/10 15:08, Ziggy Bopster wrote:
Hi Phil,
Thank you so much for responding with your recommendations.. The Ldap config varies only by Server IP, Base DN and password.. If I use option
If the bind DN passwords are different, you probably can't use this option. You'll probably need >1 ldap module.
#2, how does Free Radius know which OU to plug in when authorizing
users? Does that mean users have to enter their fully qualified login name ?
Have you read docs/rlm_ldap?
Maybe Option #1 is good if I check for Calling Station ID in the "if" statement in the authorize section?
Yes, I think that's your best option.
Thank you for your patience again with my questions.. I wasn't sure what to call what I am trying to do, so couldn't find exact documentation on it.. Do you have a link where I can find out more info on how to do this? THANK YOU SOOO MUCH.
FreeRadius basically passes each request through a series of modules. You can control the flow through these modules in various ways.
See "man unlang" for the basic documentation.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 23/09/10 16:21, Ziggy Bopster wrote:
Hi Phil,
Let me look into the docs and see if I can get something setup..
If I had one SSID and wanted multiple LDAP servers & search bases behind it, should I use Option#1.. (i.e. User selects SSID Secure.. If user is not found in LDAP search base #1, look for user in LDAP search base #2, if not found in LDAP search base #3, look for it in #4 and etc..
Yes. See doc/configurable_failover
Thank you. On Thu, Sep 23, 2010 at 8:32 AM, Phil Mayers <p.mayers@imperial.ac.uk>wrote:
On 23/09/10 16:21, Ziggy Bopster wrote:
Hi Phil,
Let me look into the docs and see if I can get something setup..
If I had one SSID and wanted multiple LDAP servers & search bases behind it, should I use Option#1.. (i.e. User selects SSID Secure.. If user is not found in LDAP search base #1, look for user in LDAP search base #2, if not found in LDAP search base #3, look for it in #4 and etc..
Yes. See doc/configurable_failover
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (2)
-
Phil Mayers -
Ziggy Bopster