Linux – How to configure openLDAP to lookup userPassword via FreeRadius

authenticationfreeradiuslinuxopenldap

I am running Ubuntu 12.04 and OpenLDAP 2.4.28-1.1ubuntu4.5. I have users populated in LDAP with userPassword attribute being an {SHA1} hash. Users are able to login over SSH and authenticate to web applications.

Now, I'd like to add Radius authentication (from an OTP server) to the LDAP server as an additional mechanism. This way, users could authenticate via their Radius 'One Time Password' but all the POSIX attributes would get pulled down from LDAP. Is this possible? What is the mechanism called?

Best Answer

Openldap 2.4 support SASL password passtrough authentication ( http://www.openldap.org/doc/admin24/security.html ).

This feature allows to delegate the authentication process to saslauthd daemon and mantains the other attributes in openldap.

This feature requires to replace the actual userPassword value with a string "{SASL}username@realm" so you can't use SHA1 password and SASL authentication for the same user. Furthermore SASL can use PAM as backend authentication method.

PAM has a module that allow to use free radius authentication. The full chain of authentication will be:

OpenLDAP Server --> saslauthd --> pam module with radius --> Freeradius server

There are two other way to solve this problem:

if your web application supports PAM authentication create a pam module that use both freeradius and ldap authentication
If your web application supports Radius authentication configure a freeradius with a OpenLDAP as backend

SSH supports already PAM and Radius authentication(the last one using a pam module).

Related Solutions

Ldap – Open LDAP Authentication – How to verify userPassword without bind

Regarding the first question:

I've worked with another LDAP system that allowed 'login' against various user attributes. The solution was to do two connections. The first connection, probably anonymously bound, queries LDAP with the user-supplied information to locate the RDN of their user object. The second connection attempts a bind-with-password with the discovered RDN and the supplied password. It's a two step process, and it works.

Though, if this app is going to get a lot of logins with supplied attributes that are not the RDN itself, it'll be a real good idea to index those attributes. It's a performance thing.

Two:

OpenLDAP supports LDAP-SSL so far as I remember (TCP/636), which may be a better route than an HTTPS tunnel. By default LDAP binds are in the clear, but there are LDAP extensions that allow additional methods. Active Directory allows NTLM LDAP-binds for instance, and I'm pretty sure LDAP has been kerberized as well at some point. I don't know what methods openLDAP supports.

Three:

I have LDAP sources that have emails of the "firstname.lastname@org.edu" format in attributes. Where it gets more dicey is with the naming attributes, and that's where my openLDAP experience falls flat. I don't know what it supports for that. I know that Active Directory allows spaces in the naming attributes, and Novell eDirectory allows both spaces and periods (though it isn't recommended to do so). Typically the naming attribute is userID and attributes like givenName, surname, emailAddress, contain the special characters. As they're not naming attributes they don't have the same restrictions.

Linux Bash – How to Sort du -h Output by Size

As of GNU coreutils 7.5 released in August 2009, sort allows a -h parameter, which allows numeric suffixes of the kind produced by du -h:

du -hs * | sort -h

If you are using a sort that does not support -h, you can install GNU Coreutils. E.g. on an older Mac OS X:

brew install coreutils
du -hs * | gsort -h

From sort manual:

-h, --human-numeric-sort compare human readable numbers (e.g., 2K 1G)

Best Answer

Related Solutions

Ldap – Open LDAP Authentication – How to verify userPassword without bind

Linux Bash – How to Sort du -h Output by Size

Related Topic