freeRadius against Active Directory
Hi, I am in my internship and have the task to authenticate devices over freeRadius against Active Directory (Windows Server 2008 R2). So far I managed to authenticate succesfully with freeRadius against Active Directory after I was finished with the tutorial from Deploying RADIUS. Thanks for that :-) Now I am having the problem that the devices I want to authenticate are requesting the Service-Type(Attribute 6). Do you have any idea how to set the Service-Type in Active Directory for each user? Is that even possible or do I have to configure the users file for each user and his corresponding Service-Type? Thanks in advance, Regards Martin Heinzmann Intern R&D Embedded Software DISCLAIMER: Privileged and/or Confidential information may be contained in this message. If you are not the addressee of this message, you may not copy, use or deliver this message to anyone. In such event, you should destroy the message and kindly notify the sender by reply e-mail. It is understood that opinions or conclusions that do not relate to the official business of the company are neither given nor endorsed by the company. Thank You.
Hi,
Now I am having the problem that the devices I want to authenticate are requesting the Service-Type(Attribute 6). Do you have any idea how to set the Service-Type in Active Directory for each user? Is that even possible or do I have to configure the users file for each user and his corresponding Service-Type?
service-type will have come from the NAS - if you are running FR with standard dictionaries then you would see what type of service-type is coming in eg login or authenticate-only. if you want to use policies then you can define those in eg users file, get them via LDAP (authorize), or in SQL etc. alan
Hi, I thought the whole meaning of binding a freeRadius to an Active Directory is that I have from now on just to configure Users in the AD. So every device I want to authenticate on asks the FR which then asks the AD. So the AD will answer if the User is valid and which Service-Type he has. On my AD Server I installed the Role NPS, configured a RADIUS-Client and some Network Policies. Maybe I am on the right way, maybe not... :-( The AD succesfully tells the FR if the user is valid, just that Service-Type is missing. Martin
Hi,
Now I am having the problem that the devices I want to authenticate are requesting the Service-Type(Attribute 6). Do you have any idea how to set the Service-Type in Active Directory for each user? Is that even possible or do I have to configure the users file for each user and his corresponding Service-Type?
service-type will have come from the NAS - if you are running FR with standard dictionaries then you would see what type of service-type is coming in eg login or authenticate-only. if you want to use policies then you can define those in eg users file, get them via LDAP (authorize), or in SQL etc.
alan DISCLAIMER:
Privileged and/or Confidential information may be contained in this message. If you are not the addressee of this message, you may not copy, use or deliver this message to anyone. In such event, you should destroy the message and kindly notify the sender by reply e-mail. It is understood that opinions or conclusions that do not relate to the official business of the company are neither given nor endorsed by the company. Thank You.
Hi, I thought the whole meaning of binding a freeRadius to an Active Directory is that I have from now on just to configure Users in the AD. So every device I want to authenticate on asks the FR which then asks the AD. So the AD will answer if the User is valid and which Service-Type he has. On my AD Server I installed the Role NPS, configured a RADIUS-Client and some Network Policies. Maybe I am on the right way, maybe not... :-( The AD succesfully tells the FR if the user is valid, just that Service-Type is missing.
Martin
hi, as stated in the doc on deployingradius: "In this configuration, we are using Active Directory as an authentication oracle, and not as an LDAP database." So it seems that you will not get any attributes back from AD. If your NAS expects the Service-Type attribute you would have to add it on the fly from your FreeRADIUS configuration. Greetings, -- Dr. Michael Schwartzkopff Guardinistr. 63 81375 München Tel: (0163) 172 50 98 Fax: (089) 620 304 13
On 09/10/12 07:51, Martin.Heinzmann@belden.com wrote:
Hi, I thought the whole meaning of binding a freeRadius to an Active Directory is that I have from now on just to configure Users in the AD. So every device I want to authenticate on asks the FR which then asks the AD. So the AD will answer if the User is valid and which Service-Type he has.
Service-Type is a RADIUS thing. AD is a Microsoft LDAP server & some other protocols. It doesn't have a Service-Type attribute. You will need to query AD, and define a mapping from some AD attribute to Service-Type. You will need to use the "ldap" module for this; see in particular ldap.attrmap that lets you define mappings from LDAP attributes to RADIUS reply attributes. Note: the LDAP bit of AD is really separate from the "authentication" bit. They're separate, and are configured separately.
On my AD Server I installed the Role NPS, configured a RADIUS-Client and some Network Policies. Maybe I am on the right way, maybe not... :-(
I doubt it. I don't see how that would help.
The AD succesfully tells the FR if the user is valid, just that Service-Type is missing.
Again - Service-Type is a RADIUS thing. AD doesn't speak RADIUS. You need to define a translation / mapping.
Thank you guys very much. With your hints and a tutorial I found then( http://www.perkinsblog.net/blog/index.php/2010/02/freeradius-and-windows-ad/ ) I managed to make it work :-) Thanks again Martin DISCLAIMER: Privileged and/or Confidential information may be contained in this message. If you are not the addressee of this message, you may not copy, use or deliver this message to anyone. In such event, you should destroy the message and kindly notify the sender by reply e-mail. It is understood that opinions or conclusions that do not relate to the official business of the company are neither given nor endorsed by the company. Thank You.
participants (4)
-
alan buxey -
Martin.Heinzmann＠belden.com -
Michael Schwartzkopff -
Phil Mayers