Diffrent authentication based by SSID
Hi. I'm new with FreeRadius. I would like to use FreeRadius to authenticate two groups of users. One group for local staff based on eap-tls, second group to others based on OpenLdap authentication. My AP's have 2 SSID's broadcasting. One for the staff, second for others. Is there a possibility, to use one radius server to handle this scenario? Regards Marcin
Marcin wrote:
I'm new with FreeRadius. I would like to use FreeRadius to authenticate two groups of users. One group for local staff based on eap-tls, second group to others based on OpenLdap authentication. My AP's have 2 SSID's broadcasting. One for the staff, second for others. Is there a possibility, to use one radius server to handle this scenario?
Yes. Just update the SQL queries to include the SSID. And update the SQL database to include the SSID. Alan DeKok.
Do I realy need database? When I should use it? Can You explain a little bit more? Regards Marcin Dnia 25 lipca 2013 14:26 Alan DeKok <aland@deployingradius.com> napisał(a): Marcin wrote: > I'm new with FreeRadius. I would like to use FreeRadius to authenticate > two groups of users. One group for local staff based on eap-tls, second > group to others based on OpenLdap authentication. My AP's have 2 SSID's > broadcasting. One for the staff, second for others. Is there a > possibility, to use one radius server to handle this scenario? Yes. Just update the SQL queries to include the SSID. And update the SQL database to include the SSID. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hello. In that situation i need to have active, both sql and ldap, authorization modules in inner-tunnel. So users, who should identify by login/pass in guest SSID, can be authenticate via inner-tunnel ldap module. I don't want this. Regards Marcin Dnia 25 lipca 2013 21:31 Marcin <bierioza@o2.pl> napisał(a): Do I realy need database? When I should use it? Can You explain a little bit more? Regards Marcin Dnia 25 lipca 2013 14:26 Alan DeKok <aland@deployingradius.com> napisał(a): Marcin wrote: > I'm new with FreeRadius. I would like to use FreeRadius to authenticate > two groups of users. One group for local staff based on eap-tls, second > group to others based on OpenLdap authentication. My AP's have 2 SSID's > broadcasting. One for the staff, second for others. Is there a > possibility, to use one radius server to handle this scenario? Yes. Just update the SQL queries to include the SSID. And update the SQL database to include the SSID. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi,
In that situation i need to have active, both sql and ldap, authorization modules in inner-tunnel. So users, who should identify by login/pass in guest SSID, can be authenticate via inner-tunnel ldap module. I don't want this.
use whatever you want to use. what do you use now? all you need to do is distinguish between the two types of requests. and handle them how you want. will the guest SSID be 802.1X if so, inner-tunnel is available by default (as thats used for EAP) - if not, then you wont configure anything in there. each SSID will be presented to your RADIUS server with particular attributes...you will be able to use those to decide what to do.... eg if (%{whatever-attribute} =~ /sometext/ ) { ldap } else { sql } that sort of thing. and to be honest. you WILL need some decent data source for advancing your RADIUS into something scalable and usable...ie SQL or LDAP - sticking with a flat users file will end up with tears in most systems. alan
participants (3)
-
A.L.M.Buxey@lboro.ac.uk -
Alan DeKok -
Marcin