Re: Active directory groups

2011-05-20 Thread Doty, Seth
I must be doing something wrong in my filtering because it keeps dumping me into unclassified instead of passing the group I assigned. I have setup a security group specifically for this test and i am indeed in the group. I set it up like this in sites-enabled/inner-tunnel because it seemed this

Re: Active directory groups

2011-05-20 Thread Phil Mayers
On 20/05/11 15:14, Doty, Seth wrote: I must be doing something wrong in my filtering because it keeps dumping me into unclassified instead of passing the group I assigned. I have setup a security group specifically for this test and i am indeed in the group. I set it up like this in

Re: Active directory groups

2011-05-20 Thread Doty, Seth
I changed my baseDN to: basedn = ou=test,dc=AD,dc=ne,dc=gov and this results in the same failure in the group section. rlm_ldap: object not found rlm_ldap::ldap_groupcmp: search failed I cant remove the ou=test portion or authentication fails completely and i get a reject: [ldap] performing

Re: Active directory groups

2011-05-20 Thread Phil Mayers
On 20/05/11 16:27, Doty, Seth wrote: I changed my baseDN to: basedn = ou=test,dc=AD,dc=ne,dc=gov and this results in the same failure in the group section. rlm_ldap: object not found rlm_ldap::ldap_groupcmp: search failed I cant remove the ou=test portion or authentication fails completely and

Re: Active directory groups

2011-05-20 Thread Doty, Seth
That is the fun i am having. The baseDN of dc=AD,dc=ne,dc=gov DOES work from ldapsearch and these are actually the credentials i have received from our LDAP admins. One of the more specific options I received must be wrong That all being said though you are responding with an answer that at

Re: Active directory groups

2011-05-18 Thread Marc Phillips
So far I have the ldap component querying AD correctly and I have the ntlm_auth component doing the same and each individually passing from a radtest. My question now revolves around passing the groups in our setup and if this is even possible using the protocols listed above. Unfortunately,

Re: Active directory groups

2011-05-18 Thread Phil Mayers
On 18/05/11 16:21, Doty, Seth wrote: So far I have the ldap component querying AD correctly and I have the ntlm_auth component doing the same and each individually passing from a radtest. My question now revolves around passing the groups in our setup and if this is even possible using the

RE: Active directory groups

2011-05-18 Thread Gary Gatten
=waddell@lists.freeradius.org [mailto:freeradius-users-bounces+ggatten=waddell@lists.freeradius.org] On Behalf Of Phil Mayers Sent: Wednesday, May 18, 2011 10:58 AM To: freeradius-users@lists.freeradius.org Subject: Re: Active directory groups On 18/05/11 16:21, Doty, Seth wrote: So far I

Re: Active directory groups

2011-05-18 Thread Phil Mayers
On 18/05/11 17:22, Gary Gatten wrote: If one has (just for example) 1000 groups, this is a lot of overhead Sure (I did see your query the other day - I just haven't had a chance to write up a reply, but see below) - checking every group. Also, what if they belong to several groups?