From 605fd5e51ad99a2b330cfa20d4ba2bd249927b9b Mon Sep 17 00:00:00 2001 From: Michael Date: Mon, 15 Jan 2018 14:21:11 +0100 Subject: [PATCH] net/freeradius: Add search filter to LDAP (#488) --- net/freeradius/Makefile | 2 +- .../OPNsense/Freeradius/forms/ldap.xml | 12 +++++ .../app/models/OPNsense/Freeradius/Ldap.xml | 8 +++ .../OPNsense/Freeradius/mods-enabled-ldap | 51 +++++++++++++++++-- .../OPNsense/Freeradius/sites-enabled-default | 5 ++ 5 files changed, 74 insertions(+), 4 deletions(-) diff --git a/net/freeradius/Makefile b/net/freeradius/Makefile index 4b8bd02ea..2bfb15184 100644 --- a/net/freeradius/Makefile +++ b/net/freeradius/Makefile @@ -1,5 +1,5 @@ PLUGIN_NAME= freeradius -PLUGIN_VERSION= 1.5.0 +PLUGIN_VERSION= 1.5.1 PLUGIN_COMMENT= RADIUS Authentication, Authorization and Accounting Server PLUGIN_DEPENDS= freeradius3 PLUGIN_MAINTAINER= m.muenz@gmail.com diff --git a/net/freeradius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/forms/ldap.xml b/net/freeradius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/forms/ldap.xml index bb91a2d01..38fa2a650 100644 --- a/net/freeradius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/forms/ldap.xml +++ b/net/freeradius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/forms/ldap.xml @@ -29,4 +29,16 @@ text Set the Base DN in format dc=example,dc=domain,dc=com + + ldap.user_filter + + text + Set the filter to search for users, for Active Directory change uid to samaccountname. + + + ldap.group_filter + + text + Filter for group objects, should match all available group objects a user might be a member of. + diff --git a/net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/Ldap.xml b/net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/Ldap.xml index 36cc65f6a..3797eb5e5 100644 --- a/net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/Ldap.xml +++ b/net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/Ldap.xml @@ -24,5 +24,13 @@ dc=example,dc=domain,dc=com N + + (uid=%{%{Stripped-User-Name}:-%{User-Name}}) + N + + + (objectClass=posixGroup) + N + diff --git a/net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/mods-enabled-ldap b/net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/mods-enabled-ldap index 06d302f21..7b14fbbb5 100644 --- a/net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/mods-enabled-ldap +++ b/net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/mods-enabled-ldap @@ -16,24 +16,70 @@ ldap { {% if helpers.exists('OPNsense.freeradius.ldap.base_dn') and OPNsense.freeradius.ldap.base_dn != '' %} base_dn = '{{ OPNsense.freeradius.ldap.base_dn }}' {% endif %} -{% raw %} sasl { } update { + control:Auth-Type := 'radiusAuthType' + control:Simultaneous-Use := 'radiusSimultaneousUse' + control:Called-Station-Id := 'radiusCalledStationId' + control:Calling-Station-Id := 'radiusCallingStationId' + control:LM-Password := 'lmPassword' + control:NT-Password := 'ntPassword' + control:LM-Password := 'sambaLmPassword' + control:NT-Password := 'sambaNtPassword' + control:LM-Password := 'dBCSPwd' control:Password-With-Header += 'userPassword' + control:SMB-Account-CTRL-TEXT := 'acctFlags' + control:Expiration := 'radiusExpiration' + control:NAS-IP-Address := 'radiusNASIpAddress' + reply:Service-Type := 'radiusServiceType' + reply:Framed-Protocol := 'radiusFramedProtocol' + reply:Framed-IP-Address := 'radiusFramedIPAddress' + reply:Framed-IP-Netmask := 'radiusFramedIPNetmask' + reply:Framed-Route := 'radiusFramedRoute' + reply:Framed-Routing := 'radiusFramedRouting' + reply:Filter-Id := 'radiusFilterId' + reply:Framed-MTU := 'radiusFramedMTU' + reply:Framed-Compression := 'radiusFramedCompression' + reply:Login-IP-Host := 'radiusLoginIPHost' + reply:Login-Service := 'radiusLoginService' + reply:Login-TCP-Port := 'radiusLoginTCPPort' + reply:Callback-Number := 'radiusCallbackNumber' + reply:Callback-Id := 'radiusCallbackId' + reply:Framed-IPX-Network := 'radiusFramedIPXNetwork' + reply:Class := 'radiusClass' + reply:Session-Timeout := 'radiusSessionTimeout' + reply:Idle-Timeout := 'radiusIdleTimeout' + reply:Termination-Action := 'radiusTerminationAction' + reply:Login-LAT-Service := 'radiusLoginLATService' + reply:Login-LAT-Node := 'radiusLoginLATNode' + reply:Login-LAT-Group := 'radiusLoginLATGroup' + reply:Framed-AppleTalk-Link := 'radiusFramedAppleTalkLink' + reply:Framed-AppleTalk-Network := 'radiusFramedAppleTalkNetwork' + reply:Framed-AppleTalk-Zone := 'radiusFramedAppleTalkZone' + reply:Port-Limit := 'radiusPortLimit' + reply:Login-LAT-Port := 'radiusLoginLATPort' + reply:Reply-Message := 'radiusReplyMessage' + reply:Tunnel-Type := 'radiusTunnelType' + reply:Tunnel-Medium-Type := 'radiusTunnelMediumType' + reply:Tunnel-Private-Group-Id := 'radiusTunnelPrivateGroupId' control: += 'radiusControlAttribute' request: += 'radiusRequestAttribute' reply: += 'radiusReplyAttribute' } user { base_dn = "${..base_dn}" - filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" +{% if helpers.exists('OPNsense.freeradius.ldap.user_filter') and OPNsense.freeradius.ldap.user_filter != '' %} + filter = "{{ OPNsense.freeradius.ldap.user_filter }}" +{% endif %} sasl { } } group { base_dn = "${..base_dn}" +{% if helpers.exists('OPNsense.freeradius.ldap.group_filter') and OPNsense.freeradius.ldap.group_filter != '' %} filter = '(objectClass=posixGroup)' +{% endif %} membership_attribute = 'memberOf' } profile { @@ -111,6 +157,5 @@ ldap { } } -{% endraw %} {% endif %} {% endif %} diff --git a/net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/sites-enabled-default b/net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/sites-enabled-default index dc3c6bec3..5dd630e5e 100644 --- a/net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/sites-enabled-default +++ b/net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/sites-enabled-default @@ -58,6 +58,11 @@ authorize { -sql {% if helpers.exists('OPNsense.freeradius.general.ldap_enabled') and OPNsense.freeradius.general.ldap_enabled == '1' %} ldap + if ((ok || updated) && User-Password) { + update control { + Auth-Type := ldap + } + } {% else %} -ldap {% endif %}