AD group Auth

[Matthew Newton]

On Thu, 2019-08-15 at 14:13 +0200, Alex Jordaan wrote:
> I configured the winbind and joined it to the AD domain
> I configured Freeradius to use mschap with ntlm_auth to authenticate
> the users from AD
> 
> This worked fine.
> 
> I am now trying to configure the system to only allow authentication
> if a user belongs to a specific group on AD

You might be able to use the rlm_unix module to compare the group, when
you're using winbind, but I wouldn't.

You've already been advised to use the ldap module. Your debug output
hasn't got either the unix or ldap modules in it.

Configure rlm_ldap, and use that. It's the best solution for AD groups.

Then you'll need to use "LDAP-Group" to compare instead of "Group".

LDAP instructions are all on the wiki.

-- 
Matthew