The radiusd.conf on the 10.5 server has this entry. opendirectory { authtype = opendirectory } Do I need to comment the above opendirectory module out in order to use the ldap module? ldap module is below ldap { server = "ldap.your.domain" # identity = "cn=admin,o=My Org,c=UA" # password = mypass basedn = "o=My Org,c=UA" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" # base_filter = "(objectclass=radiusprofile)" # set this to 'yes' to use TLS encrypted connections # to the LDAP database by using the StartTLS extended # operation. # The StartTLS operation is supposed to be used with normal # ldap connections instead of using ldaps (port 689) connections start_tls = no # tls_cacertfile = /path/to/cacert.pem # tls_cacertdir = /path/to/ca/dir/ # tls_certfile = /path/to/radius.crt # tls_keyfile = /path/to/radius.key # tls_randfile = /path/to/rnd # tls_require_cert = "demand" # default_profile = "cn=radprofile,ou=dialup,o=My Org,c=UA" # profile_attribute = "radiusProfileDn" access_attr = "dialupAccess" # Mapping of RADIUS dictionary attributes to LDAP # directory attributes. dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 # # NOTICE: The password_header directive is NOT case insensitive # # password_header = "{clear}" # # Set: # password_attribute = nspmPassword # # to get the user's password from a Novell eDirectory # backend. This will work *only if* freeRADIUS is # configured to build with --with-edir option. # # # The server can usually figure this out on its own, and pull # the correct User-Password or NT-Password from the database. # # Note that NT-Passwords MUST be stored as a 32-digit hex # string, and MUST start off with "0x", such as: # # 0x000102030405060708090a0b0c0d0e0f # # Without the leading "0x", NT-Passwords will not work. # This goes for NT-Passwords stored in SQL, too. # # password_attribute = userPassword # # Un-comment the following to disable Novell eDirectory account # policy check and intruder detection. This will work *only if* # FreeRADIUS is configured to build with --with-edir option. # # edir_account_policy_check=no # # groupname_attribute = cn # groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" # groupmembership_attribute = radiusGroupName timeout = 4 timelimit = 3 net_timeout = 1 # compare_check_items = yes # do_xlat = yes # access_attr_used_for_allow = yes # # By default, if the packet contains a User-Password, # and no other module is configured to handle the # authentication, the LDAP module sets itself to do # LDAP bind for authentication. # # You can disable this behavior by setting the following # configuration entry to "no". # # allowed values: {no, yes} # set_auth_type = yes } Thanks, Aaron FreeRadius users mailing list <freeradius-users@lists.freeradius.org> writes:

Aaron_Hovel@pikeschool.org wrote:

...

What I would like to do next is have the PrimaryGroupID or the gidNumber in Opendirectory for that particular user passed back to, in this case an Aruba Controller, so that the Aruba Controller can authorize the user based on the group membership.

raddb/ldap.attrmap.

OpenDirectory is just an LDAP server.

Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Sorry about posting the default config. If I understand correctly, I need to configure the ldap config for my network and then use the attrmap to request the correct ldap attribute from the ldap server. Is this correct? Thanks, Aaron FreeRadius users mailing list <freeradius-users@lists.freeradius.org> writes:

Aaron_Hovel@pikeschool.org wrote:

...

The radiusd.conf on the 10.5 server has this entry. opendirectory { authtype = opendirectory }

The OpenDirectory module takes no configuration. It does what Apple wants...

...

Do I need to comment the above opendirectory module out in order to use the ldap module? ldap module is below

Please don't post default configurations to the list. We've seen them before. Lots.

You don't need to uncomment the opendirectory module to use LDAP.

Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html