Can't figure out Group Authentication

[Alan DeKok]

Julson, Jim wrote:
> Okay, so I think I’m getting closer.  But I have a few challenges
> still.  I am slowly learning how to parse the RADIUS –X debug output,
> now it’s a matter of knowing what to do with the information.

  Use the handy form at:

networkradius.com/freeradius.html

  It tells you the important things to look at.

> 1.  Domain Groups with spaces sometimes would or wouldn't work.  (Is
> that the case with FreeRADIUS?) 

  It shouldn't be, but you never know.

> 2.  Recursive searches were a problem.  See below for how the basic
> Active Directory structure looks for us (Note the spaces in the names). 
> For Cacti, I had to create a new OU, with a new Security Group that
> didn’t have spaces in it.  That was the only way I could get LDAP Binds
> to work for Group Authentication.  (I find it hard to belive that’s the
> case with FreeRADIUS…I tend to lean more towards my bad configuration).

  Recursive searches are supported in FreeRADIUS.  See the "rebind"
configuration in the ldap module.

> So, in that example, if I wanted to have a user be Authenticated who
> resides in “ADMIN – Users”, but the group is in “ADMIN – Groups”, does
> it matter to the RADIUS LDAP module?

  It shouldn't.

> NOTE:  I am kind of lost here.  I see so many people using so many
> different syntaxes that I’m not sure if I’m using the right one.

  The documentation is correct.  Almost every third-party site is wrong.

>  At
> present, the “users” file is completely default except for the following
> lines I’ve added at the very top.   So, no matter what my LDAP output
> shows, If I uncomment the two lines for ntlm_auth, I can login with any
> Domain User regardless of the top 2 lines that say “Domain Admins”, and
> all others are rejected.  So I’m thinking ultimately my problem is not
> just here, but also with the LDAP bind taking place as you can see below. 
> **************************************
> */etc/raddb/users** *
>  
> DEFAULT Ldap-Group == "CN=Domain Admins,CN=ADMIN -
> Groups,DC=DOMAIN,DC=HOME,DC=COM",

  You just need the group name "admin" or "sales".  Not the whole path.

> Auth-Type = ntlm_auth
> DEFAULT Auth-Type = Reject

  You don't need the default reject.  The server will ALWAYS reject
people it doesn't know.

> Here’s the RADIUSD –X output from my last auth attempt.
>  
> BEGIN RADIUS – X DEBUG OUTPUT
> NOTE:  I’ve changed all my domain information for this troubleshooting,
> and also highlighted anywhere it’s referenced.  I’m hoping I’m
> On the right track with what I’ve highlighted below as to where I
> believe the problem is.

  Part of the reason for the debug output is to show you what's going
on.  It prints out the LDAP queries it does.  You can copy them, and use
them in command-line tests with "ldapsearch".  That helps.

  Alan DeKok.