Hi Authur,
On Jun 24, 9:41pm, Authur Lin wrote:
> Subject: (RADIATOR) Give me some suggestions for Authentication, Authoriza
> Hello,
>
> We know the radius can process all about authentication, authorization,
> and accounting. Whether it is possible if I use radius for
> authentication/accounting, LDAP for authorization ? Could anyone give
> me some suggestions ?
Sounds like you want to authenticate and do accounting to a remote radius
server, but to get check and reply items from an LDAP server?
You can do this by chaining 2 AuthBy clauses together:
<Realm whatever>
AuthByPolicy ContinueAlways
# Check items from LDAP, if they pass the check items
# Note, no PasswordAttr, so password is not checked
<AuthBy LDAP>
CheckAttr check-attr
ReplyAttr reply-attr
....etc
</AuthBy>
<AuthBy RADIUS>
Host whatever
Secret whatever
</AuthBy>
</Realm>
In this strategy, the user will be prechecked with check items (but not a
password) from LDAP. If the check items are OK, it applies the reply items.
Then the request is sent to the remote radius. Any reply items from the remote
radius will be added to the ones from LDAP.
Accounting will just go to remote radius.
In the LDAP database, you could have a DEFAULT user to handle the most common
cases, and some per-user entries for the unusual usuaers:
uid: DEFAULT
reply-attr: "Service-Type=Framed-User"
reply-attr: "Framed-Protocol = PPP"
uid: mrstatic
reply-attr: "Service-Type=Framed-User"
reply-attr: "Framed-Protocol = PPP"
reply-attr: "Framed-IP-Address = 1.2.3.4"
Hope that helps.
Cheers.
>
> Authur
>
>
>
>
> ===
> Archive at http://www.thesite.com.au/~radiator/
> To unsubscribe, email '[EMAIL PROTECTED]' with
> 'unsubscribe radiator' in the body of the message.
>-- End of excerpt from Authur Lin
--
Mike McCauley [EMAIL PROTECTED]
Open System Consultants Pty. Ltd Unix, Perl, Motif, C++, WWW
24 Bateman St Hampton, VIC 3188 Australia http://www.open.com.au
Phone +61 3 9598-0985 Fax +61 3 9598-0955
Radiator: the most portable, flexible and configurable RADIUS server
anywhere. SQL, proxy, DBM, files, LDAP, NIS+, password, NT, Emerald,
Platypus, Freeside, TACACS+, PAM, external, etc etc on Unix, Win95/8,
NT, Rhapsody
===
Archive at http://www.thesite.com.au/~radiator/
To unsubscribe, email '[EMAIL PROTECTED]' with
'unsubscribe radiator' in the body of the message.
