ldap group membership required

[Daniel Durgin]

Thank you for the quick reply.  I beat my head against it again, and 
again.  Then noticed the clients file.  I got it working.

Alan DeKok wrote:
> Daniel Durgin wrote:
>> I have search the archives and google, and there seems to be lots of
>> confusion on the subject: Requiring membership to and LDAP group to
>> authenticate.
> 
>   No.
> 
>   Authentication involves checking credentials.  Authorization involves
> *additional* and *independent* filter rules specifying when and where
> people can authenticate.
> 
>   If you think of checking group membership as authentication, it means
> that you're conceptual model of how the system works is wrong.  Hence
> designs of any solution will be wrong, and confusion will be multiplied.
> 
>> I can seem to get it to work.  Notice the misspelling og the member:
>>
>> dn: cn=radius_wifi,ou=Groups,dc=fu,dc=bar
>> cn: min_radius_wifi
>> objectClass: groupOfNames
>> objectClass: top
>> member: cn=tes guest,ou=Guests,dc=fu,dc=bar
>>
>>
>> The real user, cn=test guest,ou=Guests,dc=fu,dc=bar, is still able to
>> login.
> 
>   So... read the debug output to see why.  This is mentioned in no many
> places that there is NO excuse for not doing it.
> 
>   I also fail to understand why people look at the *configuration* to
> see how the server is *running*.    It's like driving car while looking
> only at a map, and not at the road in front of you.  If all goes well,
> it might work.  But as soon as a pedestrian steps in front of your car,
> you fail to see him, and *boom*, bad things happen.
> 
>> FreeRadius Version: freeradius-1.0.1
> 
>   Why?  That version is *years* old.

It comes with CentOS 5, or one of them Yum Repos.  I just needed a 
radius server to gateway for my LDAP server.

>   Alan DeKok
> -
> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html


Thank you for the lesson I learned a lot.

-Dan