Hy all, I am not sure how to configure my scenario. I explain it to you: We have 3 LDAP servers running. We authenticate against one or other depending the type of access (GPRS, Callback...). I am going to create three instances of the ldap module. But I dont know how and where to say which is the instance to use for the authorization and authentication in each case. For example, if I have a GPRS access I would like to authenticate against my first LDAP server (instance ldap1). How can I say to the FreeRadius server to use the authenticate method of the l1 instance? Thanks Regards, Peter ______________________________________________ LLama Gratis a cualquier PC del Mundo. Llamadas a fijos y móviles desde 1 céntimo por minuto. http://es.voice.yahoo.com
I will try to explain it better In my modules section I have: modules { ... ldap2 interface1 { server = 10.x.y.a ... } ldap2 interface2 { server = 10.x.y.b ... } ldap2 interface3 { server = 10.x.y.c ... } ... } In the authenticate section I have: authenticate { ...... Auth-Type LDAP1 { interface1 } Auth-Type LDAP2 { interface2 } Auth-Type LDAP3 { interface3 } .... } In my authorize section I have: authorize{ .... files ... } In my users file I have: DEFAULT NAS-IP-Address == a.b.c.d, Auth-Type :=LDAP1 DEFAULT NAS-IP-Address == a2.b2.c2.d2, Auth-Type :=LDAP2 DEFAULT NAS-IP-Address == a3.b3.c3.d3, Auth-Type :=LDAP3 How can I say to FreeRadius in the authorize section (after processing files module) which authorize method to use(depending on the NAS-IP-Address of the Access-Request packet)? For example, in my case, if the NAS-IP-Address is a.b.c.d I would like to use the authorize method of the interface1 module. If the NAS-IP-Address is a2.b2.c2.d2 I would like to use the authorize method of the interface2 module... Thanks a lot :-) --- Peter Manckok <peter_manckok@yahoo.es> escribió:
Hy all,
I am not sure how to configure my scenario.
I explain it to you:
We have 3 LDAP servers running. We authenticate against one or other depending the type of access (GPRS, Callback...).
I am going to create three instances of the ldap module. But I dont know how and where to say which is the instance to use for the authorization and authentication in each case. For example, if I have a GPRS access I would like to authenticate against my first LDAP server (instance ldap1). How can I say to the FreeRadius server to use the authenticate method of the l1 instance?
Thanks Regards, Peter
______________________________________________ LLama Gratis a cualquier PC del Mundo. Llamadas a fijos y móviles desde 1 céntimo por minuto. http://es.voice.yahoo.com - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
______________________________________________ LLama Gratis a cualquier PC del Mundo. Llamadas a fijos y móviles desde 1 céntimo por minuto. http://es.voice.yahoo.com
Peter Manckok wrote:
authenticate { ...... Auth-Type LDAP1 { interface1 } Auth-Type LDAP2 { interface2 } Auth-Type LDAP3 { interface3 } .... }
In my authorize section I have: authorize{ .... files ... }
In my users file I have: DEFAULT NAS-IP-Address == a.b.c.d, Auth-Type :=LDAP1 DEFAULT NAS-IP-Address == a2.b2.c2.d2, Auth-Type :=LDAP2 DEFAULT NAS-IP-Address == a3.b3.c3.d3, Auth-Type :=LDAP3
Provided there's nothing after the "files" in "authorize" that might be (re)setting Auth-Type, that should work. Don't snip bits out - what is the full contents of the authorize and authenticate sections? What does the radius server say when you run it in debug mode (with -X)?
--- Phil Mayers <p.mayers@imperial.ac.uk> escribió:
Peter Manckok wrote:
authenticate { ...... Auth-Type LDAP1 { interface1 } Auth-Type LDAP2 { interface2 } Auth-Type LDAP3 { interface3 } .... }
In my authorize section I have: authorize{ .... files ... }
In my users file I have: DEFAULT NAS-IP-Address == a.b.c.d, Auth-Type
:=LDAP1
DEFAULT NAS-IP-Address == a2.b2.c2.d2, Auth-Type :=LDAP2 DEFAULT NAS-IP-Address == a3.b3.c3.d3, Auth-Type :=LDAP3
Provided there's nothing after the "files" in "authorize" that might be (re)setting Auth-Type, that should work.
Thanks for the warning
Don't snip bits out - what is the full contents of the authorize and authenticate sections? What does the radius server say when you run it in debug mode (with -X)? -
Hy Phil, My problem is how to select the correct authorize method of an instance depending on the NAS-IP-Address of the Access-Request packet. For example, if the NAS-IP-Address is a.b.c.d I would like to use the authorize method of interface1 (and NOT the authorize method of interface2 or interface3) I haven´t tested it yet, I am not in my company now In the authorize section I have: authorize{ preprocess suffix files ??? -------> how can I discriminate between the differents authorize methods of interface1, interface2, interface3 depending on the source NAS-IP-Address? } In the authenticate section: authenticate { Auth-Type LDAP1 { interface1 } Auth-Type LDAP2 { interface2 } Auth-Type LDAP3 { interface3 } unix } Thanks again Any hint is very appreciated Peter
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
______________________________________________ LLama Gratis a cualquier PC del Mundo. Llamadas a fijos y móviles desde 1 céntimo por minuto. http://es.voice.yahoo.com
----- Original Message ----- From: "Peter Manckok" <peter_manckok@yahoo.es> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Thursday, February 23, 2006 11:52 AM Subject: Re: how to configure my scenario
--- Phil Mayers <p.mayers@imperial.ac.uk> escribió:
Peter Manckok wrote:
authenticate { ...... Auth-Type LDAP1 { interface1 } Auth-Type LDAP2 { interface2 } Auth-Type LDAP3 { interface3 } .... }
In my authorize section I have: authorize{ .... files ... }
In my users file I have: DEFAULT NAS-IP-Address == a.b.c.d, Auth-Type
:=LDAP1
DEFAULT NAS-IP-Address == a2.b2.c2.d2, Auth-Type :=LDAP2 DEFAULT NAS-IP-Address == a3.b3.c3.d3, Auth-Type :=LDAP3
Provided there's nothing after the "files" in "authorize" that might be (re)setting Auth-Type, that should work.
Thanks for the warning
Don't snip bits out - what is the full contents of the authorize and authenticate sections? What does the radius server say when you run it in debug mode (with -X)? -
Hy Phil,
My problem is how to select the correct authorize method of an instance depending on the NAS-IP-Address of the Access-Request packet. For example, if the NAS-IP-Address is a.b.c.d I would like to use the authorize method of interface1 (and NOT the authorize method of interface2 or interface3)
I haven´t tested it yet, I am not in my company now
In the authorize section I have:
authorize{ preprocess suffix files ??? -------> how can I discriminate between the differents authorize methods of interface1, interface2, interface3 depending on the source NAS-IP-Address? }
In the authenticate section:
authenticate {
Auth-Type LDAP1 { interface1 } Auth-Type LDAP2 { interface2 } Auth-Type LDAP3 { interface3 } unix }
Thanks again
Any hint is very appreciated
Peter
Use Autz-Type to select between authorization methods
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
______________________________________________ LLama Gratis a cualquier PC del Mundo. Llamadas a fijos y móviles desde 1 céntimo por minuto. http://es.voice.yahoo.com - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi,
My problem is how to select the correct authorize method of an instance depending on the NAS-IP-Address of the Access-Request packet. For example, if the NAS-IP-Address is a.b.c.d I would like to use the authorize method of interface1 (and NOT the authorize method of interface2 or interface3)
to seperate within the authorize section, you have set Autz-Type as well. That would be DEFAULT NAS-IP-Address == a.b.c.d, Auth-Type :=LDAP1, Autz-Type := LDAP1 DEFAULT NAS-IP-Address == a2.b2.c2.d2, Auth-Type :=LDAP2, Autz-Type := LDAP2 DEFAULT NAS-IP-Address == a3.b3.c3.d3, Auth-Type :=LDAP3, Autz-Type := LDAP3 (just always make sure that files is before the interfaceX bits, to ensure that Autz-Type is already set. You can then do
authorize{ preprocess suffix files Autz-Type LDAP1 { interface1 } Autz-Type LDAP2 { interface2 } Autz-Type LDAP3 { interface3 } }
That should work, I did a very similar thing just last week :-) Greetings, Stefan Winter -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter@restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473
--- Stefan Winter <stefan.winter@restena.lu> escribió:
Hi,
My problem is how to select the correct authorize method of an instance depending on the NAS-IP-Address of the Access-Request packet. For example, if the NAS-IP-Address is a.b.c.d I would like to use the authorize method of interface1 (and NOT the authorize method of interface2 or interface3)
to seperate within the authorize section, you have set Autz-Type as well. That would be
DEFAULT NAS-IP-Address == a.b.c.d, Auth-Type :=LDAP1, Autz-Type := LDAP1 DEFAULT NAS-IP-Address == a2.b2.c2.d2, Auth-Type :=LDAP2, Autz-Type := LDAP2 DEFAULT NAS-IP-Address == a3.b3.c3.d3, Auth-Type :=LDAP3, Autz-Type := LDAP3
(just always make sure that files is before the interfaceX bits, to ensure that Autz-Type is already set. You can then do
authorize{ preprocess suffix files Autz-Type LDAP1 { interface1 } Autz-Type LDAP2 { interface2 } Autz-Type LDAP3 { interface3 } }
One question Stefan, in the Autz-Type file I read that the order should look like that: authorize{ preprocess suffix Autz-Type LDAP1 { interface1 } Autz-Type LDAP2 { interface2 } Autz-Type LDAP3 { interface3 } files } files is before or after Autz-Type lines in the authorize section? Thank you very much Peter
That should work, I did a very similar thing just last week :-)
Greetings,
Stefan Winter
-- Stefan WINTER
Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung
6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter@restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
______________________________________________ LLama Gratis a cualquier PC del Mundo. Llamadas a fijos y móviles desde 1 céntimo por minuto. http://es.voice.yahoo.com
Hi,
One question Stefan, in the Autz-Type file I read that the order should look like that:
authorize{ preprocess suffix Autz-Type LDAP1 { interface1 } Autz-Type LDAP2 { interface2 } Autz-Type LDAP3 { interface3 } files }
files is before or after Autz-Type lines in the authorize section?
Now that I think of it... I think I set Autz-Type already during preprocess, so files could be behind the Autz-Type stanzas. But it should work the other way around as well. -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter@restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473
Peter Manckok <peter_manckok@yahoo.es> wrote:
For example, if I have a GPRS access I would like to authenticate against my first LDAP server (instance ldap1). How can I say to the FreeRadius server to use the authenticate method of the l1 instance?
In 1.1.0, once you select an LDAP module during the authorization phase, it will cause itself to be run during the authenticate phase, too. Alan DeKok.
Alan DeKok wrote:
Peter Manckok <peter_manckok@yahoo.es> wrote:
For example, if I have a GPRS access I would like to authenticate against my first LDAP server (instance ldap1). How can I say to the FreeRadius server to use the authenticate method of the l1 instance?
In 1.1.0, once you select an LDAP module during the authorization phase, it will cause itself to be run during the authenticate phase, too.
I assume we can still override this (or example, to authorize with LDAP, but authenticate with kerberos) as we're doing with 1.0.5. Is this correct? -- George C. Kaplan gckaplan@ack.berkeley.edu Communication & Network Services 510-643-0496 University of California at Berkeley
participants (6)
-
Alan DeKok -
George C. Kaplan -
Peter Manckok -
Phil Mayers -
Rafael Roldán -
Stefan Winter