let radius distinguish more cases

[tnt at kalik.net]

>I have a question to understanding  better radius.
>For this i make a simple example-scenario :
>
>I want to use my radius for 2 things :
>
>1. wireless-access for laptops with machine authentication over a
>wireless switch with ip 1.1.1.1
>2. authentication for the login to my switches for some admin-users
>

Create 2 ldap instances.

>My machines (case 1) are in a samba-domain and saved in a openldap-DB
>in the tree :

ldap ldap1 { ... with this:

>basedn = "ou=samba-machines,dc=sb-brixen,dc=it"
>
>My users (case 2), where i select my admins with a ldap-filter are
>also in an openldap-dB in the tree:

and ldap ldap2 with this:

>basedn = "ou=users,dc=sb-brixen,dc=it"
>

>How and where i distinguish this 2 cases?

You can use unlang. ldap1 requests will be coming from 1.1.1.1 and won't
have Service-Type in them (that will be only for admin requests):

if (NAS-IP-Address == 1.1.1.1 && !Service-Type) {
     ldap1
}
else {
     ldap2
}

Put that in authorize (default virtual server) instead of ldap entry.
Don't bother with forcing auth type ldap - let pap module sort out
authentication.

>In  clients.conf i have defined my switches and my network.
>
>For the users-file i have seen som examples like :
>DEFAULT Huntgroup-Name = "vpn-pix",Auth-Type := ldap
>
>But where i define "Huntgroup-Name = "vpn-pix"" is this the normal
>name in the client.conf  ?
>

You define huntgroups in - huntgroups file (raddb/huntgroups). I don't
think you need them. You would use them if some admins can have access
to one group of devices and not to another.

Ivan Kalik
Kalik Informatika ISP