Hi All, I have put together a freeradius server to authenticate users existing on our oracle LDAP directory. The issue that I have is getting the passowrd from oracle. I can probe the LDAP, get a user authorized and fallback to the default for the passowrd check which is the "system". It all works well. However our LDAP uses oracle on the back end to check the password. Has anyone configured radius to do this? I need to send a request to LDAP to check the password as well. Any suggestion or help or white paper or docs.... is appreciated very much in advance. Regards, Allan Borman allan.borman@hccs.edu
"Allan Borman" <allan.borman@hccs.edu> wrote:
However our LDAP uses oracle on the back end to check the password. Has anyone configured radius to do this?
Nope. How does LDAP "use" oracle? Find that out, and you might be able to configure FreeRADIUS to do the same thing. Alan DeKok.
Allan Borman wrote:
I have put together a freeradius server to authenticate users existing on our oracle LDAP directory. The issue that I have is getting the passowrd from oracle. I can probe the LDAP, get a user authorized and fallback to the default for the passowrd check which is the "system". It all works well. However our LDAP uses oracle on the back end to check the password. Has anyone configured radius to do this? I need to send a request to LDAP to check the password as well.
That is really an Oracle LDAP directory configuration issue. FreeRADIUS doesn't really care what the backend is. It only cares that you can do LDAP bind and that LDAP directory provides password hashes. For example I can query my OpenLDAP database and it will provide me with userPassword sambaNTPassword sambaLMPassword atrributes that I can use to authenticate past that. This is not a RADIUS issue. You have to configure your LDAP directory to provide you with the right info.
Hi Valdimir, Thanks for the reply. Would it help if I send you the debug info on the RADIUS. If you are interested let me know. Regards, Allan Borman. ----- Original Message ----- From: "Vladimir Vuksan" <vlists@veus.hr> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Thursday, August 11, 2005 10:10 AM Subject: Re: freeradius and oracle LDAP
Allan Borman wrote:
I have put together a freeradius server to authenticate users existing on our oracle LDAP directory. The issue that I have is getting the passowrd from oracle. I can probe the LDAP, get a user authorized and fallback to the default for the passowrd check which is the "system". It all works well. However our LDAP uses oracle on the back end to check the password. Has anyone configured radius to do this? I need to send a request to LDAP to check the password as well.
That is really an Oracle LDAP directory configuration issue. FreeRADIUS doesn't really care what the backend is. It only cares that you can do LDAP bind and that LDAP directory provides password hashes. For example I can query my OpenLDAP database and it will provide me with
userPassword sambaNTPassword sambaLMPassword
atrributes that I can use to authenticate past that. This is not a RADIUS issue. You have to configure your LDAP directory to provide you with the right info. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Allan Borman wrote:
Hi Valdimir, Thanks for the reply. Would it help if I send you the debug info on the RADIUS. If you are interested let me know.
I don't think that would help any. First of all you have to make sure that LDAP is providing the right information before you try to get it going with RADIUS. For example if you can do an LDAP search as the admin user against your Oracle LDAP database you should be able to configure FreeRADIUS easily ie. ldapsearch -x -D 'uid=root,dc=yourorg,dc=com' 'uid=allan' and than confirm that the right attributes are being provided by the LDAP. Vladimir
Thanks. I will try this. I have composed searches on LDAP and figured out the filter that I need to use to get the UID but not the password. Thanks for the info. If I get it to work I will post the information for the others as well. ----- Original Message ----- From: "Vladimir Vuksan" <vlists@veus.hr> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Thursday, August 11, 2005 2:23 PM Subject: Re: freeradius and oracle LDAP
Allan Borman wrote:
Hi Valdimir, Thanks for the reply. Would it help if I send you the debug info on the RADIUS. If you are interested let me know.
I don't think that would help any. First of all you have to make sure that LDAP is providing the right information before you try to get it going with RADIUS. For example if you can do an LDAP search as the admin user against your Oracle LDAP database you should be able to configure FreeRADIUS easily ie.
ldapsearch -x -D 'uid=root,dc=yourorg,dc=com' 'uid=allan'
and than confirm that the right attributes are being provided by the LDAP.
Vladimir - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (3)
-
Alan DeKok -
Allan Borman -
Vladimir Vuksan