Access based on eDirectory and Accounting
Hello list, I am looking for a solution that will allow a captive portal to authenticate against eDirectory but also check the accounting database to ensure a user has not exceeded their bandwidth allocation. I would prefer not to import the eDirectory users into a SQL database but rather keep the actual users in eDirectory but I am not sure if Freeradius can authenticate off of eDirectory and also check accounting information in a SQL db before allowing access. I have used a pure SQL backend and it worked great but need advise on the above. Can anyone tell me if this would require source hacking or if this is a straight forward configuration. And if anyone knows of a web management front end for Freeradius besides the following that I have already looked at, that would be great: Dialup Admin, ARA and Radius Manager. Commercial solutions aswell. Thanks, Martin
I am looking for a solution that will allow a captive portal to authenticate against eDirectory but also check the accounting database to ensure a user has not exceeded their bandwidth allocation. I would prefer not to import the eDirectory users into a SQL database but rather keep the actual users in eDirectory but I am not sure if Freeradius can authenticate off of eDirectory and also check accounting information in a SQL db before allowing access. I have used a pure SQL backend and it worked great but need advise on the above.
Yes. eDirectory will "replace" radcheck and radreply while accounting will go to radacct.
Can anyone tell me if this would require source hacking or if this is a straight forward configuration.
Straight forward.
And if anyone knows of a web management front end for Freeradius besides the following that I have already looked at, that would be great: Dialup Admin, ARA and Radius Manager. Commercial solutions aswell.
daloRadius. Ivan Kalik Kalik Informatika ISP
On 30 Jan 2009, at 11:50, <tnt@kalik.net> <tnt@kalik.net> wrote:
Yes. eDirectory will "replace" radcheck and radreply while accounting will go to radacct.
I was under the impression that radcheck would have to check eDirectory and accounting info. I want to allow access based on eDirectory credentials AND accounting info. So if the eDirectory credentials are correct Freeradius should check the accounting database and if the total bytes transferred is more than a value specified somewhere (either in eDirectory or SQL I suppose) reject access. Bottom line, I want to prevent access if a user has used more than X bandwidth.
Yes. eDirectory will "replace" radcheck and radreply while accounting will go to radacct.
I was under the impression that radcheck would have to check eDirectory and accounting info.
No. eDirectory will be searched by ldap module.
I want to allow access based on eDirectory credentials AND accounting info. So if the eDirectory credentials are correct Freeradius should check the accounting database and if the total bytes transferred is more than a value specified somewhere (either in eDirectory or SQL I suppose) reject access.
You can store (sql)counter limit in eDirectory. Just add the mapping to ldap.attrmap. Ivan Kalik Kalik Informatika ISP
participants (2)
-
Martin Potgieter -
tnt＠kalik.net