Proxy on Fail.. Or intelligent proxy...Or Utilize multiple acocunt directories
Good afternoon all; I am looking at configuring FR to Auth accounts across multiple account directories. Basically I would like FR to take in PAP queries, attempt Auth against krb, then if that comes back as a fail, try a secondary Radius server (Eduroam...) or module (Shibboleth). We are looking at this as we foresee collisions occurring between accounts residing within other universities and our local guest accounts (which use email address as the principal). Any ideas where and with what I should start testing with (as in create virtual servers an d pass a single success and fail on multi fail..) Thank you Larry
Larry Ross wrote:
I am looking at configuring FR to Auth accounts across multiple account directories. Basically I would like FR to take in PAP queries, attempt Auth against krb, then if that comes back as a fail, try a secondary Radius server (Eduroam…) or module (Shibboleth).
That's hard.
We are looking at this as we foresee collisions occurring between accounts residing within other universities and our local guest accounts (which use email address as the principal).
The simple answer is "don't have colliding usernames". Use email addresses for logins, *especially* for roaming users from other universities. Having colliding usernames is very bad for a number of reasons. Alan DeKok.
Hi Larry, I am doing this same thing... I've modified the PAP and LDAP sections, in /etc/raddb/sites-enabled/{default,inner-tunnel}, to do this and it works well. authenticate { # # PAP authentication, when a back-end database listed # in the 'authorize' section supplies a password. The # password can be clear-text, or encrypted. Auth-Type PAP { #pap group{ pap{ reject = 1 ok = return } ntlm_auth{ reject = 1 ok = return } } } ... I do the same for Auth-Type LDAP. Hope this helps. Cheers, Harry On 02/08/2010 09:42 PM, Alan DeKok wrote:
Larry Ross wrote:
I am looking at configuring FR to Auth accounts across multiple account directories. Basically I would like FR to take in PAP queries, attempt Auth against krb, then if that comes back as a fail, try a secondary Radius server (Eduroam…) or module (Shibboleth).
That's hard.
We are looking at this as we foresee collisions occurring between accounts residing within other universities and our local guest accounts (which use email address as the principal).
The simple answer is "don't have colliding usernames".
Use email addresses for logins, *especially* for roaming users from other universities.
Having colliding usernames is very bad for a number of reasons.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (3)
-
Alan DeKok -
Harry Hoffman -
Larry Ross