LDAP Group Against AD Issue
Good Day, I am attempting to setup FreeRADIUS 3.0.11 against a single Active Directory. I am also trying to use AD via LDAP to check group membership for authorization. The authentication (via MSCHAPv2) is working fine, but I am having issues with group memberships. If the user manually authenticates with their sAMAccoutnName (i.e. systest) everything works as expected. However, when automatic authentication is done by windows, the username is sent in the domain\username pattern, and my LDAP group checks fail. I end up trying to search AD for "DOMAIN\5c5c\5c5csystest" which doesn't work: (7) ldap: EXPAND (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) (7) ldap: --> (sAMAccountName=applause\5c5csystest) (7) ldap: Performing search in "OU=User Accounts,DC=corp,DC=applause,DC=com" with filter "(sAMAccountName=applause\5c5csystest)", scope "sub" (7) ldap: Waiting for search result... (7) ldap: Search returned no results It appears that proxy is the way to go, but it doesn't seem to be stripping the realm once it's located. Any pointers are appreciated. I've been working on this for days and just can't resolve this portion. -Matt
Hi,
(7) ldap: EXPAND (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) (7) ldap: --> (sAMAccountName=applause\5c5csystest) (7) ldap: Performing search in "OU=User Accounts,DC=corp,DC=applause,DC=com" with filter "(sAMAccountName=applause\5c5csystest)", scope "sub"
sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}} but you are getting applause\5c5csystest fed through....which means stripped-user-name isnt populated - so just ensure that either 1) you have your domaion listed in proxy.conf eg applause { } and that prefix is being called before ldap module etc or 2) set stripped-user-name yourself with some unlang and a regex to the pattern of the user-name (messy/hacky but will als do the job - just doing 1) and letting freeradius deal with it all is the best way.....) alan
On Mar 21, 2016, at 10:39 AM, Matt Brennan <brennanma@gmail.com> wrote:
I am attempting to setup FreeRADIUS 3.0.11 against a single Active Directory. I am also trying to use AD via LDAP to check group membership for authorization. The authentication (via MSCHAPv2) is working fine, but I am having issues with group memberships.
If the user manually authenticates with their sAMAccoutnName (i.e. systest) everything works as expected. However, when automatic authentication is done by windows, the username is sent in the domain\username pattern, and my LDAP group checks fail. I end up trying to search AD for "DOMAIN\5c5c\5c5csystest" which doesn't work:
That's a fun Windows problem. If the sAMAccoutnName is the "name" portion of the DOMAIN\name blob, you can put this in proxy.conf: realm applause { } And uncomment the "ntdomain" entry in raddb/sites-enabled/default, in the "authorize" section. Also, read the comments there. The "ntdomain" module will see "applause\systest", and create a Stripped-User-Name of "sestets". The LDAP module will then use that Stripped-User-Name in order to do group checks. Alan DeKok.
participants (3)
-
A.L.M.Buxey＠lboro.ac.uk -
Alan DeKok -
Matt Brennan