FreeRADIUS + Cisco + Active Directory

[Mathieu Simon (Lists)]

Am 06.01.2016 um 13:20 schrieb Phil Mayers:
> On 06/01/16 11:28, Matthew Newton wrote:
> 
>> Exactly. What's wrong with LDAP here?
> 
> Nested groups can be a pain.

They are often, I'd agree. I don't know how much performance penalty
there is for these AD specific queries but I recently got it ported from
a 2.x config I had. The initial thing back then I found was on a blog
from a Nasser Heidari*. The AD in question is by no means large for what
I can tell, thus: YMMV.

This is what used to work for me on 2.1/2.2 in modules/ldap:

groupmembership_filter =
"(&(objectcategory=group)(member:1.2.840.113556.1.4.1941:=%{control:Ldap-UserDn}))"

In 3.0 mods-available/ldap I had to split it slightly to:

filter = '(objectCategory=group)'
membership_filter =
"(member:1.2.840.113556.1.4.1941:=%{control:Ldap-UserDn})"

Now if this is totally wrong, I'm happy to learn how its done better.
:-) For what I can tell so far all nested memberships were retrieved
when I tried to trick it.

I was actually surprised how much I could easily port from a 2.x config
to 3.0 without much effort, great job! (I know I'm late to game of
FreeRADIUS 3.0). I actually like the changes that were made to the ldap
module so far.

-- Mathieu

*
https://linax.wordpress.com/2012/07/17/freeradius-check-nested-ldap-group-membership/