My use case is RADIUS for network device auth, with IPA doing the underlying authentication. The group information is all the LDAP groups a user belongs to. This is for access control. Our current setup uses an ancient version of RADIUS that runs on an old Solaris 9 Sparc server. It uses the users and groups on that server to control access. ______________________________________________________________________________________________
Daniel E. White [email protected]<mailto:[email protected]> NICS Linux Engineer NASA Goddard Space Flight Center 8800 Greenbelt Road Building 14, Room E175 Greenbelt, MD 20771 Office: (301) 286-6919 Mobile: (240) 513-5290 From: Alex Scheel <[email protected]> Date: Wednesday, February 12, 2020 at 13:38 To: FreeIPA users list <[email protected]> Cc: Daniel White <[email protected]> Subject: [EXTERNAL] Re: [Freeipa-users] FreeIPA and FreeRadius (or any RADIUS) Hi Daniel, I'm afraid I don't understand what you're trying to accomplish. There's two primary use cases for RADIUS: - RADIUS for wireless auth, with IPA doing the underlying authentication - RADIUS as a backend for OTP, with IPA passing OTP queries to RADIUS to validate I'm going to guess by your request that you want the former, not the latter. What you're looking for is probably most easily accomplished via an LDAP interface for FreeRADIUS. I think the following might help you: - https://wiki.freeradius.org/modules/Rlm_ldap - http://lists.freeradius.org/pipermail/freeradius-users/2018-April/091159.html I'm not sure what group information you'd need in this scenario, though. If you're trying to use RADIUS to do authenticate on systems, we don't support pam_radius (and the authenticating system doesn't get group information in that setup). Would sssd be a better fit in this case? Thanks, - Alex ----- Original Message ----- From: "Daniel E. White (GSFC-770.0)[NICS] via FreeIPA-users" <[email protected]<mailto:[email protected]>> To: "FreeIPA users list" <[email protected]<mailto:[email protected]>> Cc: "Daniel E. White (GSFC-770.0)[NICS]" <[email protected]<mailto:[email protected]>> Sent: Wednesday, February 12, 2020 8:54:31 AM Subject: [Freeipa-users] FreeIPA and FreeRadius (or any RADIUS) Reference: https://urldefense.proofpoint.com/v2/url?u=https-3A__www.freeipa.org_page_Using-5FFreeIPA-5Fand-5FFreeRadius-5Fas-5Fa-5FRADIUS-5Fbased-5Fsoftware-5Ftoken-5FOTP-5Fsystem-5Fwith-5FCentOS_RedHat-5F7&d=DwICaQ&c=ApwzowJNAKKw3xye91w7BE1XMRKi2LN9kiMk5Csz9Zk&r=ef_FKlWa7jWGmQqTrjkcoDY1VuVtcI_10ClISjA3_V8&m=Zv18qJEsJdA0-rTvhk7KGER54Nbj5PvUpkhG972d7Eg&s=DL7kkmJr_YPGHUDd7C98avLEo5MftauoY_rs7FLEv7U&e= What about setting it up so that RADIUS gets credentials and groups from FreeIPA without the OTP ? ______________________________________________________________________________________________ Daniel E. White [email protected]<mailto:[email protected]><mailto:[email protected]> NICS Linux Engineer NASA Goddard Space Flight Center 8800 Greenbelt Road Building 14, Room E175 Greenbelt, MD 20771 Office: (301) 286-6919 Mobile: (240) 513-5290 _______________________________________________ FreeIPA-users mailing list -- [email protected]<mailto:[email protected]> To unsubscribe send an email to [email protected]<mailto:[email protected]> Fedora Code of Conduct: https://urldefense.proofpoint.com/v2/url?u=https-3A__docs.fedoraproject.org_en-2DUS_project_code-2Dof-2Dconduct_&d=DwICaQ&c=ApwzowJNAKKw3xye91w7BE1XMRKi2LN9kiMk5Csz9Zk&r=ef_FKlWa7jWGmQqTrjkcoDY1VuVtcI_10ClISjA3_V8&m=Zv18qJEsJdA0-rTvhk7KGER54Nbj5PvUpkhG972d7Eg&s=ObQjZAozegq76dn-3bRKzfZZJlGNlJboMt7jq9yfkOg&e= List Guidelines: https://urldefense.proofpoint.com/v2/url?u=https-3A__fedoraproject.org_wiki_Mailing-5Flist-5Fguidelines&d=DwICaQ&c=ApwzowJNAKKw3xye91w7BE1XMRKi2LN9kiMk5Csz9Zk&r=ef_FKlWa7jWGmQqTrjkcoDY1VuVtcI_10ClISjA3_V8&m=Zv18qJEsJdA0-rTvhk7KGER54Nbj5PvUpkhG972d7Eg&s=icoYxkNKtZLQukECmYuY-8EvRmB1QwYagUq8NC5WCWc&e= List Archives: https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.fedorahosted.org_archives_list_freeipa-2Dusers-40lists.fedorahosted.org&d=DwICaQ&c=ApwzowJNAKKw3xye91w7BE1XMRKi2LN9kiMk5Csz9Zk&r=ef_FKlWa7jWGmQqTrjkcoDY1VuVtcI_10ClISjA3_V8&m=Zv18qJEsJdA0-rTvhk7KGER54Nbj5PvUpkhG972d7Eg&s=9osDDUoPdZ6iuCCpMmjTwKFdKAAs2JSoJAG8IpDm284&e=
_______________________________________________ FreeIPA-users mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/[email protected]
