netbird/plugins
0
0
Fork 0
mirror of https://github.com/netbirdio/plugins.git synced 2026-05-22 18:44:07 -07:00
Code Issues Packages Projects Releases Wiki Activity

net/freeradius: Add basic LDAP support to FreeRADIUS (#444)

Browse Source
This commit is contained in:
Michael
2017-12-24 10:28:45 +01:00
committed by Franco Fichtner
parent 28884146d8
commit f666bdb216
13 changed files with 372 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
net/freeradius/Makefile
+1 -1
View File
@@ -1,5 +1,5 @@
PLUGIN_NAME= freeradius
PLUGIN_VERSION= 1.4.1
PLUGIN_VERSION= 1.5.0
PLUGIN_COMMENT= RADIUS Authentication, Authorization and Accounting Server
PLUGIN_DEPENDS= freeradius3
PLUGIN_MAINTAINER= m.muenz@gmail.com
net/freeradius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/Api/LdapController.php
+39
View File
@@ -0,0 +1,39 @@
<?php
/**
* Copyright (C) 2015 - 2017 Deciso B.V.
* Copyright (C) 2017 Michael Muenz
*
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are met:
*
* 1. Redistributions of source code must retain the above copyright notice,
* this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
* INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
* AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
* AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
* OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*
*/
namespace OPNsense\Freeradius\Api;
use \OPNsense\Base\ApiMutableModelControllerBase;
class LdapController extends ApiMutableModelControllerBase
{
static protected $internalModelName = 'ldap';
static protected $internalModelClass = '\OPNsense\Freeradius\Ldap';
}
net/freeradius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/LdapController.php
+38
View File
@@ -0,0 +1,38 @@
<?php
/*
* Copyright (C) 2017 Michael Muenz
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are met:
*
* 1. Redistributions of source code must retain the above copyright notice,
* this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
* INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
* AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
* AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
* OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*/
namespace OPNsense\Freeradius;
class LdapController extends \OPNsense\Base\IndexController
{
public function indexAction()
{
$this->view->ldapForm = $this->getForm("ldap");
$this->view->pick('OPNsense/Freeradius/ldap');
}
}
net/freeradius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/forms/general.xml
+6
View File
@@ -11,6 +11,12 @@
<type>checkbox</type>
<help>This allows you to dynamically assign VLANs on your physical switch ports.</help>
</field>
<field>
<id>general.ldap_enabled</id>
<label>Enable LDAP</label>
<type>checkbox</type>
<help>This allows you to bind to an external LDAP server. Be aware that FreeRADIUS will not start if there is no further configuration.</help>
</field>
<field>
<id>general.wispr</id>
<label>Enable WISPr attributes</label>
net/freeradius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/forms/ldap.xml
+32
View File
@@ -0,0 +1,32 @@
<form>
<field>
<id>ldap.protocol</id>
<label>Protocol Type</label>
<type>dropdown</type>
<help>Set the protocol to use.</help>
</field>
<field>
<id>ldap.server</id>
<label>Server</label>
<type>text</type>
<help>Set the hostname or IP address to connect to.</help>
</field>
<field>
<id>ldap.identity</id>
<label>Bind User</label>
<type>text</type>
<help>Username to bind to LDAP, same format as in Base DN.</help>
</field>
<field>
<id>ldap.password</id>
<label>Bind Password</label>
<type>password</type>
<help>Password for the bind user.</help>
</field>
<field>
<id>ldap.base_dn</id>
<label>Base DN</label>
<type>text</type>
<help>Set the Base DN in format dc=example,dc=domain,dc=com</help>
</field>
</form>
net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/General.xml
+4
View File
@@ -11,6 +11,10 @@
<default>0</default>
<Required>N</Required>
</vlanassign>
<ldap_enabled type="BooleanField">
<default>0</default>
<Required>N</Required>
</ldap_enabled>
<wispr type="BooleanField">
<default>0</default>
<Required>N</Required>
net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/Ldap.php
+34
View File
@@ -0,0 +1,34 @@
<?php
namespace OPNsense\Freeradius;
use OPNsense\Base\BaseModel;
/*
Copyright (C) 2017 Michael Muenz
All rights reserved.
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:
1. Redistributions of source code must retain the above copyright notice,
this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright
notice, this list of conditions and the following disclaimer in the
documentation and/or other materials provided with the distribution.
THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
POSSIBILITY OF SUCH DAMAGE.
*/
class Ldap extends BaseModel
{
}
net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/Ldap.xml
+29
View File
@@ -0,0 +1,29 @@
<model>
<mount>//OPNsense/freeradius/ldap</mount>
<description>LDAP configuration</description>
<version>1.0.0</version>
<items>
<protocol type="OptionField">
<default>LDAPS</default>
<Required>Y</Required>
<OptionValues>
<LDAP>LDAP</LDAP>
<LDAPS>LDAPS</LDAPS>
</OptionValues>
</protocol>
<server type="TextField">
<Required>N</Required>
</server>
<identity type="TextField">
<Required>N</Required>
</identity>
<password type="TextField">
<Required>N</Required>
</password>
<base_dn type="TextField">
<default>dc=example,dc=domain,dc=com</default>
<Required>N</Required>
</base_dn>
</items>
</model>
net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/Menu/Menu.xml
+1
View File
@@ -5,6 +5,7 @@
<Users url="/ui/freeradius/user/index" order="20"/>
<Clients url="/ui/freeradius/client/index" order="30"/>
<EAP url="/ui/freeradius/eap/index" order="40"/>
<LDAP url="/ui/freeradius/ldap/index" order="50"/>
<LogFile VisibleName="Log File" order="80" url="/diag_logs_freeradius.php"/>
</FreeRADIUS>
</Services>
net/freeradius/src/opnsense/mvc/app/views/OPNsense/Freeradius/ldap.volt
+62
View File
@@ -0,0 +1,62 @@
{#
OPNsense® is Copyright © 2014 – 2017 by Deciso B.V.
This file is Copyright © 2017 by Michael Muenz
All rights reserved.
Redistribution and use in source and binary forms, with or without modification,
are permitted provided that the following conditions are met:
1. Redistributions of source code must retain the above copyright notice,
this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright notice,
this list of conditions and the following disclaimer in the documentation
and/or other materials provided with the distribution.
THIS SOFTWARE IS PROVIDED “AS IS” AND ANY EXPRESS OR IMPLIED WARRANTIES,
INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
POSSIBILITY OF SUCH DAMAGE.
#}
<div class="content-box" style="padding-bottom: 1.5em;">
{{ partial("layout_partials/base_form",['fields':ldapForm,'id':'frm_ldap_settings'])}}
<div class="col-md-12">
<hr />
<button class="btn btn-primary" id="saveAct" type="button"><b>{{ lang._('Save') }}</b> <i id="saveAct_progress" class=""></i></button>
</div>
</div>
<script type="text/javascript">
$( document ).ready(function () {
var data_get_map = {'frm_ldap_settings':"/api/freeradius/ldap/get"};
mapDataToFormUI(data_get_map).done(function (data) {
formatTokenizersUI();
$('.selectpicker').selectpicker('refresh');
});
ajaxCall(url="/api/freeradius/service/status", sendData={}, callback=function (data, status) {
updateServiceStatusUI(data['status']);
});
// link save button to API set action
$("#saveAct").click(function () {
saveFormToEndpoint(url="/api/freeradius/ldap/set", formid='frm_ldap_settings',callback_ok=function () {
$("#saveAct_progress").addClass("fa fa-spinner fa-pulse");
ajaxCall(url="/api/freeradius/service/reconfigure", sendData={}, callback=function (data,status) {
ajaxCall(url="/api/freeradius/service/status", sendData={}, callback=function (data,status) {
updateServiceStatusUI(data['status']);
});
$("#saveAct_progress").removeClass("fa fa-spinner fa-pulse");
});
});
});
});
</script>
net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/+TARGETS
+1
View File
@@ -2,6 +2,7 @@ clients.conf:/usr/local/etc/raddb/clients.conf
dictionary:/usr/local/etc/raddb/dictionary
mods-enabled-counter:/usr/local/etc/raddb/mods-enabled/counter
mods-enabled-eap:/usr/local/etc/raddb/mods-enabled/eap
mods-enabled-ldap:/usr/local/etc/raddb/mods-enabled/ldap
radiusd:/etc/rc.conf.d/radiusd
radiusd.conf:/usr/local/etc/raddb/radiusd.conf
sites-enabled-default:/usr/local/etc/raddb/sites-enabled/default
net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/mods-enabled-ldap
+116
View File
@@ -0,0 +1,116 @@
{% if helpers.exists('OPNsense.freeradius.general.enabled') and OPNsense.freeradius.general.enabled == '1' %}
{% if helpers.exists('OPNsense.freeradius.general.ldap_enabled') and OPNsense.freeradius.general.ldap_enabled == '1' %}
ldap {
{% if helpers.exists('OPNsense.freeradius.ldap.server') and OPNsense.freeradius.ldap.server != '' %}
server = '{{ OPNsense.freeradius.ldap.protocol }}://{{ OPNsense.freeradius.ldap.server }}'
{% endif %}
{% if helpers.exists('OPNsense.freeradius.ldap.identity') and OPNsense.freeradius.ldap.identity != '' %}
identity = '{{ OPNsense.freeradius.ldap.identity }}'
{% endif %}
{% if helpers.exists('OPNsense.freeradius.ldap.password') and OPNsense.freeradius.ldap.password != '' %}
password = {{ OPNsense.freeradius.ldap.password }}
{% endif %}
{% if helpers.exists('OPNsense.freeradius.ldap.base_dn') and OPNsense.freeradius.ldap.base_dn != '' %}
base_dn = '{{ OPNsense.freeradius.ldap.base_dn }}'
{% endif %}
{% raw %}
sasl {
}
update {
control:Password-With-Header += 'userPassword'
control: += 'radiusControlAttribute'
request: += 'radiusRequestAttribute'
reply: += 'radiusReplyAttribute'
}
user {
base_dn = "${..base_dn}"
filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})"
sasl {
}
}
group {
base_dn = "${..base_dn}"
filter = '(objectClass=posixGroup)'
membership_attribute = 'memberOf'
}
profile {
}
client {
base_dn = "${..base_dn}"
filter = '(objectClass=radiusClient)'
template {
}
attribute {
ipaddr = 'radiusClientIdentifier'
secret = 'radiusClientSecret'
}
}
accounting {
reference = "%{tolower:type.%{Acct-Status-Type}}"
type {
start {
update {
description := "Online at %S"
}
}
interim-update {
update {
description := "Last seen at %S"
}
}
stop {
update {
description := "Offline at %S"
}
}
}
}
post-auth {
update {
description := "Authenticated at %S"
}
}
options {
chase_referrals = yes
rebind = yes
res_timeout = 10
srv_timelimit = 3
net_timeout = 1
idle = 60
probes = 3
interval = 3
ldap_debug = 0x0028
max = ${thread[pool].max_servers}
spare = ${thread[pool].max_spare_servers}
uses = 0
retry_delay = 30
lifetime = 0
idle_timeout = 60
}
tls {
require_cert = 'allow'
}
pool {
start = ${thread[pool].start_servers}
min = ${thread[pool].min_spare_servers}
max = ${thread[pool].max_servers}
spare = ${thread[pool].max_spare_servers}
uses = 0
retry_delay = 30
lifetime = 0
idle_timeout = 60
}
}
{% endraw %}
{% endif %}
{% endif %}
net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/sites-enabled-default
+9 -1
View File
@@ -56,8 +56,11 @@ authorize {
}
files
-sql
{% if helpers.exists('OPNsense.freeradius.general.ldap_enabled') and OPNsense.freeradius.general.ldap_enabled == '1' %}
ldap
{% else %}
-ldap
{% endif %}
{% if helpers.exists('OPNsense.freeradius.general.sessionlimit') and OPNsense.freeradius.general.sessionlimit == '1' %}
daily
{% endif %}
@@ -77,6 +80,11 @@ authenticate {
Auth-Type MS-CHAP {
mschap
}
{% if helpers.exists('OPNsense.freeradius.general.ldap_enabled') and OPNsense.freeradius.general.ldap_enabled == '1' %}
Auth-Type LDAP {
ldap
}
{% endif %}
mschap
digest
eap