Ian Pilcher via FreeIPA-users wrote:
Continuing my adventures with FreeRADIUS ...
It seems that there's no escaping the need to create a dedicated LDAP
user for FreeRADIUS, so that it can see group membership information.
I've already created a FreeIPA service -
radius/ipa.example.com(a)EXAMPLE.COM - so that I could issue a certificate
for PEAP and monitor it with certmonger. (Yes, FreeRADIUS is running on
the same server as FreeIPA.)
Is it possible to somehow create a "service user" associated with this
service that FreeRADIUS can use as an LDAP login?
Thanks!
You can't use the Kerberos service to store a password because it lacks
the attributes to store it. You could use potentially use a keytab but I
somehow doubt that GSSAPI auth is available.
So what I think you'll have to do is create a separate LDAP system
account, details are in the LDAP howto on
freeipa.org.
And you'll need to do a bit of manual work to allow this system account
read access to the membership info. You can do this by using ldapmodify
to add memberof: <permission> for the permission (or permissions) you
need to grant it.
rob