Tim Tyler wrote:
> Freeradius experts,
> I want to use one freeradius server to authenticate against a
> system file for students and against ldap for faculty/staff. I can
> get the system file to work alone. I can get the ldap module to work
> alone. But I can't seem to find a way to get both of them to work
> together. If I set DEFAULT Auth-Type = System in the users file, it
> authenticates the system files. If I set it to ldap, it
> authenticates to ldap.
Which is why we recommend not using Auth-Type. Almost everyone uses
> If I put both in the users file, it
> authenticates ldap users only.
See "man rlm_users" for why. It's doing what you tell it to do, not
what you expect it to do.
> How do I allow both unix and ldap
> modules to authenticate their respective users? Note: users are
> unique to each module. A user in unix does not exist in ldap and vice versa.
Don't authenticate people via LDAP. LDAP isn't an authentication
server. It's a database.
Instead, pull the password from LDAP, and let the server decide how
the user should be authenticated.
You could also set Auth-Type *conditionally*, if the user was in one
group or another.
http://deployingradius.com - The web site of the book
http://deployingradius.com/blog/ - The blog
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html