[Freeipa-users] Re: [EXTERNAL] Re: FreeIPA and FreeRadius (or any RADIUS)

[Ernedin Zajko]

Daniel,

There is nice how-to here
https://firstyear.id.au/blog/html/2016/01/13/FreeRADIUS:_Using_mschapv2_with...

--eZ

On Wed, Feb 12, 2020, 20:03 White, Daniel E. (GSFC-770.0)[NICS] via
FreeIPA-users  wrote:
> My use case is RADIUS for network device auth, with IPA doing the
> underlying authentication.
>
> The group information is all the LDAP groups a user belongs to.  This is
> for access control.
>
> Our current setup uses an ancient version of RADIUS that runs on an old
> Solaris 9 Sparc server.  It uses the users and groups on that server to
> control access.
>
> *______________________________________________________________________________________________*
>
> *Daniel E. White*
> *[e-mail] *
>
> *NICS Linux Engineer NASA Goddard Space Flight Center 8800 Greenbelt Road
> Building 14, Room E175 Greenbelt, MD 20771*
>
> *Office: [phone]*
>
> *Mobile: [phone]*
>
> *From: *Alex Scheel 
> *Date: *Wednesday, February 12, 2020 at 13:38
> *To: *FreeIPA users list 
> *Cc: *Daniel White 
> *Subject: *[EXTERNAL] Re: [Freeipa-users] FreeIPA and FreeRadius (or any
> RADIUS)
>
> Hi Daniel,
>
> I'm afraid I don't understand what you're trying to accomplish.
>
> There's two primary use cases for RADIUS:
>
> RADIUS for wireless auth, with IPA doing the underlying authentication
>
> RADIUS as a backend for OTP, with IPA passing OTP queries to RADIUS to
>
> validate
>
> I'm going to guess by your request that you want the former, not the
> latter.
>
> What you're looking for is probably most easily accomplished via an LDAP
>
> interface for FreeRADIUS. I think the following might help you:
>
> https://wiki.freeradius.org/modules/Rlm_ldap
>
> http://lists.freeradius.org/pipermail/freeradius-users/2018-April/091159.htm...
>
> I'm not sure what group information you'd need in this scenario, though.
>
> If you're trying to use RADIUS to do authenticate on systems, we don't
>
> support pam_radius (and the authenticating system doesn't get group
>
> information in that setup).
>
> Would sssd be a better fit in this case?
>
> Thanks,
> Alex
>
> ----- Original Message -----
>
> From: "Daniel E. White (GSFC-770.0)[NICS] via FreeIPA-users" <
> [e-mail]>
>
> To: "FreeIPA users list"
>
> Cc: "Daniel E. White (GSFC-770.0)[NICS]"
>
> Sent: Wednesday, February 12, 2020 8:54:31 AM
>
> Subject: [Freeipa-users] FreeIPA and FreeRadius (or any RADIUS)
>
> Reference:
>
> https://urldefense.proofpoint.com/v2/url?u=https-3A__www.freeipa.org_page_Us...
>
> What about setting it up so that RADIUS gets credentials and groups from
>
> FreeIPA without the OTP ?
>
> Daniel E. White
>
> [e-mail]<mailto:[e-mail]
> >
>
> NICS Linux Engineer
>
> NASA Goddard Space Flight Center
>
> 8800 Greenbelt Road
>
> Building 14, Room E175
>
> Greenbelt, MD 20771
>
> Office: [phone]
>
> Mobile: [phone]
>
> FreeIPA-users mailing list -- [e-mail]
>
> To unsubscribe send an email to [e-mail]
>
> Fedora Code of Conduct:
>
> https://urldefense.proofpoint.com/v2/url?u=https-3A__docs.fedoraproject.org_...
>
> List Guidelines:
> https://urldefense.proofpoint.com/v2/url?u=https-3A__fedoraproject.org_wiki_...
>
> List Archives:
>
> https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.fedorahosted.org_...
>
> FreeIPA-users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct:
> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...