Hello,
I have search the archives and google, and there seems to be lots of
confusion on the subject: Requiring membership to and LDAP group to
authenticate.
I can seem to get it to work. Notice the misspelling og the member:
dn: cn=radius_wifi,ou=Groups,dc=fu,dc=bar
cn: min_radius_wifi
objectClass: groupOfNames
objectClass: top
member: cn=tes guest,ou=Guests,dc=fu,dc=bar
The real user, cn=test guest,ou=Guests,dc=fu,dc=bar, is still able to login.
FreeRadius Version: freeradius-1.0.1
ldap {
server = "localhost"
identity = "uid=authman,dc=fu,dc=bar"
password = XXXXXXX
basedn = "dc=fu,dc=bar"
filter = "(uid=%{Stripped-User-Name:-%{User-Name}})"
base_filter = "(objectclass=person)"
# default_profile = "cn=radprofile,ou=dialup,o=My Org,c=UA"
# profile_attribute = "radiusProfileDn"
#` access_attr = "uid"
# Mapping of RADIUS dictionary attributes to LDAP
# directory attributes.
dictionary_mapping = ${raddbdir}/ldap.attrmap
ldap_connections_number = 5
password_attribute = userPassword
groupname_attribute = cn
groupmembership_filter =
"(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))"
groupmembership_attribute =
"cn=radius_wifi,ou=Group,dc=fu,dc=bar"
timeout = 4
timelimit = 3
net_timeout = 1
#compare_check_items = yes
# do_xlat = yes
# access_attr_used_for_allow = no
}
Thank you for the help,
Dan
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
