On 8/24/20 11:40 AM, Alessandro Minonzio via FreeIPA-users wrote:
I'n new about FreeIPA ( v. 4.6.5 ) and I ask help about first
configuration with FreeRadius on Centos 7.
I need documentation or suggestion about this implementation.
Could somone help me?
I set this up a while ago, so I may forget some of the
details, but
here's what I remember:
* You'll need to force LDAP authentication (bind as user) in the
relevant FreeRADIUS "sites" - probably "default" for testing
with radtest and "inner-tunnel" for WiFi EAP. I added the following
at the end of the *authorize* section (after pap).
#
# Force LDAP authentication (bind as user)
#
if (noop && User-Password) {
update control {
Auth-Type := LDAP
}
}
* In the *authenticate* section of the sites files, uncomment this
section:
# Uncomment it if you want to use ldap for authentication
#
# Note that this means "check plain-text password against
# the ldap database", which means that EAP won't work,
# as it does not supply a plain-text password.
#
# We do NOT recommend using this. LDAP servers are databases.
# They are NOT authentication servers. FreeRADIUS is an
# authentication server, and knows what to do with authentication.
# LDAP servers do not.
#
Auth-Type LDAP {
ldap
}
* Configure mods-available/ldap appropriately. You'll need to put
your LDAP (FreeIPA) server information in the *ldap* section:
server = 'localhost'
base_dn = 'cn=users,cn=accounts,dc=CHANGE,dc=ME'
(I've only ever run FreeIPA and FreeRADIUS on the same server, so I
haven't had to set up TLS between them.)
* If you want to check group membership, you'll need to create a FreeIPA
service account for FreeRADIUS. (Group membership is not visible to
anonymous binds.)
https://www.freeipa.org/page/HowTo/LDAP#System_Accounts
In mods-available/ldap (for example):
identity = 'uid=radiusd,cn=sysaccounts,cn=etc,dc=CHANGE,dc=ME'
password = somethingwaymoresecurethanthis
I've only ever "hacked" group membership-based authorization by simply
hiding users that aren't in a particular group. In the "user"
subsection of the "ldap" section of mods-available/ldap I changed the
filter to:
filter =
"(&(uid=%{%{Stripped-User-Name}:-%{User-Name}})(memberOf=cn=wifi,cn=groups,cn=accounts,dc=CHANGE,dc=ME))"
There's almost certainly a better way to do this.
* Finally, you'll need to configure mods-available/eap to use an
authentication type that works with LDAP authentication. (Something
where the supplicant sends the actual password, rather than a hash.)
I'm attaching my mods-available/eap file to this note. Note that not
all of the changes (disabling a bunch of authentication methods) are
required to make this work.
HTH
--
========================================================================
In Soviet Russia, Google searches you!
========================================================================