On 16.5.2022 15.29, Alfred Reibenschuh wrote:
i have the following setup
<Handler Suffix = @realm, NAS-Identifier = sshd, NAS-Port-Type =
Virtual, Service-Type = Authenticate-Only>
<AuthBy LDAP2>
Identifier PROXY_realm
Host realm.example.com
Port 636
# Tells Radiator to do direct LDAPS
# connection to port 636
UseSSL
# Client certificate and private key to use
SSLCAClientCert ...
SSLCAClientKey ...
# When the key is protected
SSLCAClientKeyPassword ...
BaseDN OU=realm,DC=example,DC=com
SearchFilter (cn=%1)
ServerChecksPassword
Version 3
</AuthBy>
</Handler>
now security requires a client certificate (which i have) to
authenticate the ldap connection
> how would i configure the certificate for authenticating the ldap
> connection ?
See the following in
https://files.radiatorsoftware.com/radiator/ref.pdf
3.9.21. SSLCAClientCert
3.9.22. SSLCAClientKey
3.9.23. SSLCAClientKeyPassword (starting with Radiator 4.24)
These 3 parameters set the client certificate. For an example, see
3.9.8. UseSSL.
Starting with Radiator 4.24 you can also
3.9.24. SSLExpectedServerName
SSLExpectedServerName is a fairly recent parameter, added in Radiator
4.24, that allows, for example, to set Host parameter to an IP address
and set the name that server certificate is required to have. Without
this parameter the name must match Host value.
When setting up the configuration, you can enable TLS debugging to see
how LDAP library's TLS handshake proceeds. For the details, see this
parameter:
3.9.11. DebugTLS
Note that this logging happens outside of Radiator's logging so you need
to use the methods described in the reference manual to see the log
messages that are written to STDERR.
Please let us know how it goes.
Thanks,
Heikki
--
Heikki Vatiainen
OSC, makers of Radiator
Visit radiatorsoftware.com for Radiator AAA server software
_______________________________________________
radiator mailing list
radiator@lists.open.com.au
https://lists.open.com.au/mailman/listinfo/radiator
