PAP and authenticating via AD

[Stefan Winter]

Hi,

(don't write HTML mails please)
(please use a more descriptive subject line instead of Please help !!!)
(0 or 1 exclamation mark will do, preferably 0)

first off: if you will stay with PAP later (user's password comes in in clear 
text), just treat the AD server like a plain ldap server, i.e. configure and 
activate ldap {} in both authorize and authenticate sections of radiusd.conf. 
No sign of AD specialties here.

This is in fact the recommended way: configure the ldap {} section, activate 
it and be happy. It will work.

If you will change to MS-CHAP later, only then will you need the AD way of 
authenticating users. This is what I describe below.

> users: Matched entry DEFAULT at line 152
> modcall[authorize]: module "files" returns ok for request 0
> modcall: leaving group authorize (returns ok) for request 0
> rad_check_password: Found Auth-Type System
> auth: type "System"
> Processing the authenticate section of radiusd.conf
> modcall: entering group authenticate for request 0
> rlm_unix: [test]: invalid password
> modcall[authenticate]: module "unix" returns reject for request 0
> modcall: leaving group authenticate (returns reject) for request 0
> auth: Failed to validate the user.

That line 152 in the users file sets the Auth-Type System if no other 
Auth-Type has previously been set. This is quite okay when authenticating 
users locally with PAP logins (i.e. password is on the FreeRADIUS server 
*system*). If you configure ldap {} as said above, Auth-Type will be set to 
LDAP and things will work.

If you want to use MS-CHAP login later, things will magically work out of the 
box (the mschap module is by default active in authorize and will set 
Auth-Type to MS-CHAP by itself *if* the request is indeed an MS-CHAP request 
and later authenticate users via the mschap module (in which you have to 
activate the ntlm_auth line)).

> using wbinfo -u and wbinfo -g command, able to pull the users and groups
> from AD.

This is great, you've already done the bulk of the work then. If you'll stick 
with PAP later, this work was unnecessary (ldap module will do). If you want 
to switch to MS-CHAP: uncomment the ntlm_auth line in the mschap module to 
tell the FreeRADIUS server to actually use this connection.

Greetings,

Stefan Winter

-- 
Stefan WINTER

Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de 
la Recherche - Ingénieur de recherche

6, rue Richard Coudenhove-Kalergi
L-1359 Luxembourg