RADIUS , LDAP Authentication Problem
Glacier Hi all, I'm currently running redhat linux 3 ES with kernel-2.4.21-27.EL openldap-2.0.27-17, and freeradius-1.0.1-1.RHEL3. I dont have a problem authenticating RADIUS against LDAP but the major problem is RADIUS is ignoring LDAP Expiration date for unix Accounts; what causes this?
"Thato Molise" <info@datacom.co.ls> wrote:
I dont have a problem authenticating RADIUS against LDAP but the major problem is RADIUS is ignoring LDAP Expiration date for unix Accounts; what causes this?
The server only does what you told it to do. Did you tell it to use the LDAP expiration? If so, how? If not, why do you expect do so? Alan DeKok.
How do I tell freeRADIUS to use LDAP expiration in my Configuration files. That's Exactly what to tell the server to do... Please help... T. Molise ----- Original Message ----- From: "Alan DeKok" <aland@nitros9.org> To: "Thato Molise" <info@datacom.co.ls>; "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Tuesday, July 11, 2006 6:01 PM Subject: Re: RADIUS , LDAP Authentication Problem
"Thato Molise" <info@datacom.co.ls> wrote:
I dont have a problem authenticating RADIUS against LDAP but the major problem is RADIUS is ignoring LDAP Expiration date for unix Accounts; what causes this?
The server only does what you told it to do.
Did you tell it to use the LDAP expiration? If so, how? If not, why do you expect do so?
Alan DeKok.
How do I tell freeRADIUS to use LDAP expiration in my Configuration files. That's Exactly what I WANT to tell the server to do... Please help... T. Molise
How do I tell freeRADIUS to use LDAP expiration in my Configuration files. That's Exactly what to tell the server to do... Please help...
T. Molise
----- Original Message ----- From: "Alan DeKok" <aland@nitros9.org> To: "Thato Molise" <info@datacom.co.ls>; "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Tuesday, July 11, 2006 6:01 PM Subject: Re: RADIUS , LDAP Authentication Problem
"Thato Molise" <info@datacom.co.ls> wrote:
I dont have a problem authenticating RADIUS against LDAP but the major problem is RADIUS is ignoring LDAP Expiration date for unix Accounts; what causes this?
The server only does what you told it to do.
Did you tell it to use the LDAP expiration? If so, how? If not, why do you expect do so?
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Thato Molise wrote:
How do I tell freeRADIUS to use LDAP expiration in my Configuration files. That's Exactly what to tell the server to do... Please help...
There is no built-in way, because this is not a standardised config. What format does the ldap expiration attribute have? There's an "rlm_expiration" in CVS (and possibly >1.1.0) versions of the server. If your expiration attribute is a unix timestamp (seconds since 1970) you could simply do this in ldap.attrmap: checkItem Expiration myLdapExpiryAttribute ...alternatively you could use rlm_exec to do it - for example if you have: dn: cn=username,blah objectClass: inetOrgPerson expiryDate: Wed 12 Jul 2006 ...then in ldap.attrmap do this: checkItem Expiration expiryDate ...and in radiusd.conf: modules { exec expiry { wait = yes program = "/path/to/expiry.sh" input_pairs = config output_pairs = reply } } authorize { preprocess ldap expiry # maybe other stuff } ...and make "expiry.sh" be this: #!/bin/sh EXPIRY_IN_LDAP=`date -d "$EXPIRATION" +%s` NOW=`date +%s` if [ $EXPIRY -lt $NOW ] then echo "Auth-Type := Reject" echo "Reply-Message = \"Your account has expires\"" fi This is untested, but I don't see why it shouldn't work.
Hi, The expiry Module still does not work; Let me show you my LDAP Attribute Attribute name Values shadowLastChange 13284 uid tmolise cn Thato Molise homeDirectory /home/tmolise uidNumber 501 objectClass posixAccount , shadowAccount , account , top shadowExpire 13269 gidNumber 100 gecos Thato Molise userPassword {encryp} I dont see the actual expiry date attribute but I see shadowExpire! Maybe the above attributes may help to see whats wrong..... In my ldap.attrmap I still have: checkItem Expiration radiusExpiration ----- Original Message ----- From: "Phil Mayers" <p.mayers@imperial.ac.uk> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Wednesday, July 12, 2006 7:43 PM Subject: Re: RADIUS , LDAP Authentication Problem
Thato Molise wrote:
How do I tell freeRADIUS to use LDAP expiration in my Configuration files. That's Exactly what to tell the server to do... Please help...
There is no built-in way, because this is not a standardised config.
What format does the ldap expiration attribute have?
There's an "rlm_expiration" in CVS (and possibly >1.1.0) versions of the server. If your expiration attribute is a unix timestamp (seconds since 1970) you could simply do this in ldap.attrmap:
checkItem Expiration myLdapExpiryAttribute
...alternatively you could use rlm_exec to do it - for example if you have:
dn: cn=username,blah objectClass: inetOrgPerson expiryDate: Wed 12 Jul 2006
...then in ldap.attrmap do this:
checkItem Expiration expiryDate
...and in radiusd.conf:
modules { exec expiry { wait = yes program = "/path/to/expiry.sh" input_pairs = config output_pairs = reply } }
authorize { preprocess ldap expiry # maybe other stuff }
...and make "expiry.sh" be this:
#!/bin/sh
EXPIRY_IN_LDAP=`date -d "$EXPIRATION" +%s` NOW=`date +%s`
if [ $EXPIRY -lt $NOW ] then echo "Auth-Type := Reject" echo "Reply-Message = \"Your account has expires\"" fi
This is untested, but I don't see why it shouldn't work. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (3)
-
Alan DeKok -
Phil Mayers -
Thato Molise