[Freeipa-users] Re: [EXTERNAL] Re: FreeIPA and FreeRadius (or any RADIUS)

[Alex Scheel]

Daniel,

That makes sense.

Then yes, the links I pointed to in my previous mail should help you
accomplish what you want. If you find something lacking, do let us
know.

Hope that helps,

Alex

----- Original Message -----
> From: "Daniel E. White (GSFC-770.0)[NICS] via FreeIPA-users" 
> To: "Alex Scheel" , "FreeIPA users list" 
> Cc: "Daniel E. White (GSFC-770.0)[NICS]" 
> Sent: Wednesday, February 12, 2020 2:03:03 PM
> Subject: [Freeipa-users] Re: [EXTERNAL] Re: FreeIPA and FreeRadius (or any RADIUS)
>
> My use case is RADIUS for network device auth, with IPA doing the underlying
> authentication.
> The group information is all the LDAP groups a user belongs to.  This is for
> access control.
> Our current setup uses an ancient version of RADIUS that runs on an old
> Solaris 9 Sparc server.  It uses the users and groups on that server to
> control access.
> ______________________________________________________________________________________________
>
> Daniel E. White
> [e-mail]
> NICS Linux Engineer
> NASA Goddard Space Flight Center
> 8800 Greenbelt Road
> Building 14, Room E175
> Greenbelt, MD 20771
> Office: [phone]
> Mobile: [phone]
>
> From: Alex Scheel 
> Date: Wednesday, February 12, 2020 at 13:38
> To: FreeIPA users list 
> Cc: Daniel White 
> Subject: [EXTERNAL] Re: [Freeipa-users] FreeIPA and FreeRadius (or any
> RADIUS)
>
> Hi Daniel,
>
> I'm afraid I don't understand what you're trying to accomplish.
>
> There's two primary use cases for RADIUS:
> RADIUS for wireless auth, with IPA doing the underlying authentication
> RADIUS as a backend for OTP, with IPA passing OTP queries to RADIUS to
>  validate
>
> I'm going to guess by your request that you want the former, not the latter.
>
> What you're looking for is probably most easily accomplished via an LDAP
> interface for FreeRADIUS. I think the following might help you:
>
> https://wiki.freeradius.org/modules/Rlm_ldap
>
> http://lists.freeradius.org/pipermail/freeradius-users/2018-April/091159.htm...
>
> I'm not sure what group information you'd need in this scenario, though.
>
> If you're trying to use RADIUS to do authenticate on systems, we don't
> support pam_radius (and the authenticating system doesn't get group
> information in that setup).
>
> Would sssd be a better fit in this case?
>
> Thanks,
> Alex
>
> ----- Original Message -----
> From: "Daniel E. White (GSFC-770.0)[NICS] via FreeIPA-users"
> <[e-mail]>
> To: "FreeIPA users list"
> <[e-mail]>
> Cc: "Daniel E. White (GSFC-770.0)[NICS]"
> <[e-mail]>
> Sent: Wednesday, February 12, 2020 8:54:31 AM
> Subject: [Freeipa-users] FreeIPA and FreeRadius (or any RADIUS)
> Reference:
> https://urldefense.proofpoint.com/v2/url?u=https-3A__www.freeipa.org_page_Us...
> What about setting it up so that RADIUS gets credentials and groups from
> FreeIPA without the OTP ?
> ______________________________________________________________________________________________
> Daniel E. White
> [e-mail]
> NICS Linux Engineer
> NASA Goddard Space Flight Center
> 8800 Greenbelt Road
> Building 14, Room E175
> Greenbelt, MD 20771
> Office: [phone]
> Mobile: [phone]
> _______________________________________________
> FreeIPA-users mailing list --
> [e-mail]
> To unsubscribe send an email to
> [e-mail]
> Fedora Code of Conduct:
> https://urldefense.proofpoint.com/v2/url?u=https-3A__docs.fedoraproject.org_...
> List Guidelines:
> https://urldefense.proofpoint.com/v2/url?u=https-3A__fedoraproject.org_wiki_...
> List Archives:
> https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.fedorahosted.org_...
>
> FreeIPA-users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct:
> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...