AD authorization with LDAP module? Mix with other methods necessary?
Hi, I have another general question. I have a running freeradius instance on Ubuntu for authorization against Windows AD, based on ntlm_auth. But to get more group depended post-auth capabilities I thought I can switch to LDAP module. I tested that in a test installation with OpenLDAP (instead of AD) and it worked fine. But now I was going to rollout this method to AD and failed to check the good password. Of course I'm aware that OpenLDAP and AD handles passwords differently so the surprise was not too big. So my questions are: - can I mix ntlm_auth for authorization and LDAP to do some group depended post-auth actions? - is that needed at all and there are ways to run LDAP only (in that case I probably did something wrong so far)? Thanks Uwe
From: Freeradius-Users [mailto:freeradius-users-bounces+j.waghorn1=nhs.net@lists.freeradius.org] On Behalf Of uj2.hahn@posteo.de Sent: 22 January 2020 07:11 Hi, I have another general question. I have a running freeradius instance on Ubuntu for authorization against Windows AD, based on ntlm_auth. But to get more group depended post-auth capabilities I thought I can switch to LDAP module.
I thought that a while - Alan (and I think Matthew) patiently explained (probably for the 450th time) that you *authenticate* via ntlm_auth/winbind/sss and then you *authorize* via LDAP. They know a hell of a lot more than I could ever hope to, so that's what I did. Works just fine. ******************************************************************************************************************** This message may contain confidential information. If you are not the intended recipient please inform the sender that you have received the message in error before deleting it. Please do not disclose, copy or distribute information in this e-mail or take any action in relation to its contents. To do so is strictly prohibited and may be unlawful. Thank you for your co-operation. NHSmail is the secure email and directory service available for all NHS staff in England and Scotland. NHSmail is approved for exchanging patient data and other sensitive information with NHSmail and other accredited email services. For more information and to find out how you can switch, https://portal.nhs.net/help/joiningnhsmail
On Jan 22, 2020, at 2:10 AM, uj2.hahn@posteo.de wrote:
I have a running freeradius instance on Ubuntu for authorization against Windows AD, based on ntlm_auth. But to get more group depended post-auth capabilities I thought I can switch to LDAP module.
Yes.
I tested that in a test installation with OpenLDAP (instead of AD) and it worked fine. But now I was going to rollout this method to AD and failed to check the good password. Of course I'm aware that OpenLDAP and AD handles passwords differently so the surprise was not too big.
So my questions are: - can I mix ntlm_auth for authorization and LDAP to do some group depended post-auth actions?
Yes. They're just modules. That's why they're listed separately in the configuration. Because they're separate.
- is that needed at all and there are ways to run LDAP only (in that case I probably did something wrong so far)?
AD will not export passwords to FreeRADIUS. So it's largely impossible to just use LDAP. Alan DeKok.
Thanks, Alan and Jason! And sorry to ask these questions for 451st time.... ;-) Regards Uwe On 22.01.2020 13:40, Alan DeKok wrote:
On Jan 22, 2020, at 2:10 AM, uj2.hahn@posteo.de wrote:
I have a running freeradius instance on Ubuntu for authorization against Windows AD, based on ntlm_auth. But to get more group depended post-auth capabilities I thought I can switch to LDAP module. Yes.
I tested that in a test installation with OpenLDAP (instead of AD) and it worked fine. But now I was going to rollout this method to AD and failed to check the good password. Of course I'm aware that OpenLDAP and AD handles passwords differently so the surprise was not too big.
So my questions are: - can I mix ntlm_auth for authorization and LDAP to do some group depended post-auth actions? Yes. They're just modules. That's why they're listed separately in the configuration. Because they're separate.
- is that needed at all and there are ways to run LDAP only (in that case I probably did something wrong so far)? AD will not export passwords to FreeRADIUS. So it's largely impossible to just use LDAP.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (3)
-
Alan DeKok -
uj2.hahn＠posteo.de -
WAGHORN, Jason (NHS BORDERS)