I'm curious to see if anyone using freeradius with Brocade and Active Directory and how they are successfully getting logins to work. I know that I need to add the attribute brocade-admin and I've got that configured on my AD and propagated but when I go to the Brocade/Extreme device I login with the AD credentials but the attribute doesn't get passed along. If I edit my client.conf file I can make a local username work just fine, but I don't want to manage user accounts out of freeradius, I want that managed by AD. Anyone have any insight? Thanks in advance! Luke Smith Director Network/IT Colorado Valley Communications direct: 979.247.8122 | mobile: 979.249.7376 email: lukes@coloradovalley.com<mailto:lukes@coloradovalley.com> url: http://www.cvctx.com<http://www.cvctx.com/> Confidentiality Notice: The information herein transmitted or attached is intended only for the person or entity to which this e-mail is addressed and may contain confidential and/or legally privileged material. Any review, retransmission, dissemination, other use of, or taking of any action in reliance upon this information by persons or entities other than the intended recipient is prohibited. If you have received this in error, please contact the sender immediately and delete the material from any and all computers, servers, and e-mail programs. Any views or opinions presented are solely those of the author and do not necessarily represent those of the company.
On Apr 29, 2020, at 5:06 PM, Luke Smith <LukeS@coloradovalley.com> wrote:
I'm curious to see if anyone using freeradius with Brocade and Active Directory and how they are successfully getting logins to work.
Brocade should just use standard RADIUS attributes. If it doesn't, it's very broken.
I know that I need to add the attribute brocade-admin and I've got that configured on my AD and propagated but when I go to the Brocade/Extreme device I login with the AD credentials but the attribute doesn't get passed along.
What does that mean? Hint: there is something called DEBUG MODE. It also helps to explain what you did: http://wiki.freeradius.org/list-help "I did stuff and it didn't work" is a bad question.
If I edit my client.conf file I can make a local username work just fine, but I don't want to manage user accounts out of freeradius, I want that managed by AD. Anyone have any insight? Thanks in advance!
Local users aren't defined in clients.conf. You should be able to configure AD as an authentication source for FreeRADIUS. The server has pretty good documentation for how to do this. See mods-available/ldap, especially in 3.0.20+ You can also map AD attributes to RADIUS attributes. Again, this is documented with examples in mods-available/ldap. Alan DeKok.
participants (2)
-
Alan DeKok -
Luke Smith