netbird/plugins
0
0
Fork 0
mirror of https://github.com/netbirdio/plugins.git synced 2026-05-22 18:44:07 -07:00
Code Issues Packages Projects Releases Wiki Activity

net/freeradius: Add search filter to LDAP (#488)

Browse Source
This commit is contained in:
Michael
2018-01-15 14:21:11 +01:00
committed by Franco Fichtner
parent 4304f2d4be
commit 605fd5e51a
5 changed files with 74 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
net/freeradius/Makefile
+1 -1
View File
@@ -1,5 +1,5 @@
PLUGIN_NAME= freeradius
PLUGIN_VERSION= 1.5.0
PLUGIN_VERSION= 1.5.1
PLUGIN_COMMENT= RADIUS Authentication, Authorization and Accounting Server
PLUGIN_DEPENDS= freeradius3
PLUGIN_MAINTAINER= m.muenz@gmail.com
net/freeradius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/forms/ldap.xml
+12
View File
@@ -29,4 +29,16 @@
<type>text</type>
<help>Set the Base DN in format dc=example,dc=domain,dc=com</help>
</field>
<field>
<id>ldap.user_filter</id>
<label>User Filter</label>
<type>text</type>
<help>Set the filter to search for users, for Active Directory change uid to samaccountname.</help>
</field>
<field>
<id>ldap.group_filter</id>
<label>Group Filter</label>
<type>text</type>
<help>Filter for group objects, should match all available group objects a user might be a member of.</help>
</field>
</form>
net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/Ldap.xml
+8
View File
@@ -24,5 +24,13 @@
<default>dc=example,dc=domain,dc=com</default>
<Required>N</Required>
</base_dn>
<user_filter type="TextField">
<default>(uid=%{%{Stripped-User-Name}:-%{User-Name}})</default>
<Required>N</Required>
</user_filter>
<group_filter type="TextField">
<default>(objectClass=posixGroup)</default>
<Required>N</Required>
</group_filter>
</items>
</model>
net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/mods-enabled-ldap
+48 -3
View File
@@ -16,24 +16,70 @@ ldap {
{% if helpers.exists('OPNsense.freeradius.ldap.base_dn') and OPNsense.freeradius.ldap.base_dn != '' %}
base_dn = '{{ OPNsense.freeradius.ldap.base_dn }}'
{% endif %}
{% raw %}
sasl {
}
update {
control:Auth-Type := 'radiusAuthType'
control:Simultaneous-Use := 'radiusSimultaneousUse'
control:Called-Station-Id := 'radiusCalledStationId'
control:Calling-Station-Id := 'radiusCallingStationId'
control:LM-Password := 'lmPassword'
control:NT-Password := 'ntPassword'
control:LM-Password := 'sambaLmPassword'
control:NT-Password := 'sambaNtPassword'
control:LM-Password := 'dBCSPwd'
control:Password-With-Header += 'userPassword'
control:SMB-Account-CTRL-TEXT := 'acctFlags'
control:Expiration := 'radiusExpiration'
control:NAS-IP-Address := 'radiusNASIpAddress'
reply:Service-Type := 'radiusServiceType'
reply:Framed-Protocol := 'radiusFramedProtocol'
reply:Framed-IP-Address := 'radiusFramedIPAddress'
reply:Framed-IP-Netmask := 'radiusFramedIPNetmask'
reply:Framed-Route := 'radiusFramedRoute'
reply:Framed-Routing := 'radiusFramedRouting'
reply:Filter-Id := 'radiusFilterId'
reply:Framed-MTU := 'radiusFramedMTU'
reply:Framed-Compression := 'radiusFramedCompression'
reply:Login-IP-Host := 'radiusLoginIPHost'
reply:Login-Service := 'radiusLoginService'
reply:Login-TCP-Port := 'radiusLoginTCPPort'
reply:Callback-Number := 'radiusCallbackNumber'
reply:Callback-Id := 'radiusCallbackId'
reply:Framed-IPX-Network := 'radiusFramedIPXNetwork'
reply:Class := 'radiusClass'
reply:Session-Timeout := 'radiusSessionTimeout'
reply:Idle-Timeout := 'radiusIdleTimeout'
reply:Termination-Action := 'radiusTerminationAction'
reply:Login-LAT-Service := 'radiusLoginLATService'
reply:Login-LAT-Node := 'radiusLoginLATNode'
reply:Login-LAT-Group := 'radiusLoginLATGroup'
reply:Framed-AppleTalk-Link := 'radiusFramedAppleTalkLink'
reply:Framed-AppleTalk-Network := 'radiusFramedAppleTalkNetwork'
reply:Framed-AppleTalk-Zone := 'radiusFramedAppleTalkZone'
reply:Port-Limit := 'radiusPortLimit'
reply:Login-LAT-Port := 'radiusLoginLATPort'
reply:Reply-Message := 'radiusReplyMessage'
reply:Tunnel-Type := 'radiusTunnelType'
reply:Tunnel-Medium-Type := 'radiusTunnelMediumType'
reply:Tunnel-Private-Group-Id := 'radiusTunnelPrivateGroupId'
control: += 'radiusControlAttribute'
request: += 'radiusRequestAttribute'
reply: += 'radiusReplyAttribute'
}
user {
base_dn = "${..base_dn}"
filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})"
{% if helpers.exists('OPNsense.freeradius.ldap.user_filter') and OPNsense.freeradius.ldap.user_filter != '' %}
filter = "{{ OPNsense.freeradius.ldap.user_filter }}"
{% endif %}
sasl {
}
}
group {
base_dn = "${..base_dn}"
{% if helpers.exists('OPNsense.freeradius.ldap.group_filter') and OPNsense.freeradius.ldap.group_filter != '' %}
filter = '(objectClass=posixGroup)'
{% endif %}
membership_attribute = 'memberOf'
}
profile {
@@ -111,6 +157,5 @@ ldap {
}
}
{% endraw %}
{% endif %}
{% endif %}
net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/sites-enabled-default
+5
View File
@@ -58,6 +58,11 @@ authorize {
-sql
{% if helpers.exists('OPNsense.freeradius.general.ldap_enabled') and OPNsense.freeradius.general.ldap_enabled == '1' %}
ldap
if ((ok || updated) && User-Password) {
update control {
Auth-Type := ldap
}
}
{% else %}
-ldap
{% endif %}