FreeRadius DHCP against LDAP

[Nikolaos Milas]

On 31/8/2013 12:03 πμ, Arran Cudbard-Bell wrote:

>> 1. Is DHCP functionality supported against an LDAP Server (in v2.2.0)?
>
> Yes. 

I am having a hard time trying to adapt the example at: 
http://wiki.freeradius.org/guide/dhcp-for-static-ip-allocation to work 
from ldap.

We are starting from a point where we have an (LDAP) DIT branch 
ou=hosts,dc=example,dc=com, where hosts are stored (also used for 
MAC-Auth), using entries of the form:

dn: cn=host1.tech,ou=hosts,dc=example,dc=com
cn: host1.tech
objectClass: device
objectClass: ieee802Device
objectClass: top
objectClass: radiusprofile
objectClass: simpleSecurityObject
description: Main Workstation at Tech Dpt
ou: tech
l: Sierra Nevada
userPassword: test123
owner: cn=TechAdmins,ou=Groups,dc=example,dc=com
radiusTunnelMediumType: IEEE-802
radiusTunnelType: VLAN
radiusNASIpAddress: 10.10.10.125
radiusTunnelPrivateGroupId: 1
macAddress: 00:24:8b:3a:d1:db
radiusTerminationAction: 33
radiusHint: 50004
radiusFramedIPAddress: 10.10.10.63
radiusArapSecurity: 10.10.10.1
radiusArapZoneAccess: 255.255.255.128

We are attempting to assign the host (using DHCP) with the macAdress 
stored at macAddress attribute:

- the IP Address defined at radiusFramedIPAddress
- the gateway defined at radiusArapSecurity
- the mask defined at radiusArapZoneAccess

Can we use ldap calls (as when doing auth), in modules/ldap, like:

ldap ldap_dhcp {

         server = "localhost"

         identity = "uid=auth,ou=AdminAccounts,dc=example,dc=com"

         password = "mysecret"

         basedn = "ou=hosts,dc=example,dc=com"

         filter = "(macAddress=%{DHCP-Client-Hardware-Address})"

         start_tls = no

         dictionary_mapping = ${raddbdir}/ldap.attrmap

         ldap_connections_number = 2

         timeout = 4

         timelimit = 3

         net_timeout = 1

}


...having added in ldap.attr the following (using current unused 
freeradius schema attributes):

replyItem       DHCP-Subnet-Mask              radiusArapZoneAccess

replyItem       DHCP-Router-Address          radiusArapSecurity

replyItem       DHCP-Your-IP-Address         radiusFramedIPAddress


and then modify the example as follows:

     server dhcp {

         listen {

             type = dhcp

             ipaddr = 127.0.0.1

             port = 67

             interface = eth0

             broadcast = no

         }

         dhcp DHCP-Discover {

             ldap_dhcp

             update reply {

                 DHCP-Message-Type = DHCP-Offer

             }

             update reply {

                 DHCP-Domain-Name-Server := 10.10.10.90

                 DHCP-Domain-Name-Server := 10.10.10.91

}

ok

         }

         dhcp DHCP-Request {

             update reply {

                 DHCP-Message-Type = DHCP-Ack

             }

             ldap_dhcp

             update reply {
                 DHCP-Domain-Name-Server := 10.10.10.90
                 DHCP-Domain-Name-Server := 10.10.10.91
             }

             ok

         }

         dhcp {

             reject

         }

     }

...??

Is it correct as above? Do I have to call ldap_dhcp separately in each 
section (i.e. twice)?

Please clarify!

Regards,
Nick