parent
b6749b2785
commit
b90858bd32
GPG Key ID:
E2ACF65D0DF94F98
@ -0,0 +1,16 @@ |
||||
FROM osixia/openldap:1.5.0 |
||||
# USE THIS VARIABLES IN .ldif files |
||||
# {{ LDAP_BASE_DN }} |
||||
# {{ LDAP_BACKEND }} |
||||
# {{ LDAP_DOMAIN }} |
||||
# {{ LDAP_READONLY_USER_USERNAME }} |
||||
# {{ LDAP_READONLY_USER_PASSWORD_ENCRYPTED }} |
||||
ADD ./*.ldif /container/service/slapd/assets/config/bootstrap/ldif/custom |
||||
ADD ./*.schema /container/service/slapd/assets/config/bootstrap/ldif/custom |
||||
ENV LDAP_ORGANISATION="ATerekhin test domain" |
||||
ENV LDAP_DOMAIN="bearns.me" |
||||
ENV LDAP_ADMIN_PASSWORD="WlnTd9_mtw5-4" |
||||
ENV LDAP_TLS=false |
||||
ENV LDAP_READONLY_USER=true |
||||
ENV LDAP_OPENLDAP_GID=911 |
||||
ENV LDAP_OPENLDAP_UID=911 |
||||
@ -0,0 +1,80 @@ |
||||
dn: cn=freeradius-radius,cn=schema,cn=config |
||||
objectClass: olcSchemaConfig |
||||
cn: freeradius-radius |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.1 NAME 'radiusArapFeatures' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.2 NAME 'radiusArapSecurity' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.3 NAME 'radiusArapZoneAccess' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.44 NAME 'radiusAuthType' DESC 'controlItem: Auth-Type' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.4 NAME 'radiusCallbackId' DESC 'replyItem: Callback-Id' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.5 NAME 'radiusCallbackNumber' DESC 'replyItem: Callback-Number' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.6 NAME 'radiusCalledStationId' DESC 'controlItem: Called-Station-Id' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.7 NAME 'radiusCallingStationId' DESC 'controlItem: Calling-Station-Id' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.8 NAME 'radiusClass' DESC 'replyItem: Class' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.45 NAME 'radiusClientIPAddress' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.9 NAME 'radiusFilterId' DESC 'replyItem: Filter-Id' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.10 NAME 'radiusFramedAppleTalkLink' DESC 'replyItem: Framed-AppleTalk-Link' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.11 NAME 'radiusFramedAppleTalkNetwork' DESC 'replyItem: Framed-AppleTalk-Network' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.12 NAME 'radiusFramedAppleTalkZone' DESC 'replyItem: Framed-AppleTalk-Zone' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.13 NAME 'radiusFramedCompression' DESC 'replyItem: Framed-Compression' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.14 NAME 'radiusFramedIPAddress' DESC 'replyItem: Framed-IP-Address' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.15 NAME 'radiusFramedIPNetmask' DESC 'replyItem: Framed-IP-Netmask' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.16 NAME 'radiusFramedIPXNetwork' DESC 'replyItem: Framed-IPX-Network' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.17 NAME 'radiusFramedMTU' DESC 'replyItem: Framed-MTU' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.18 NAME 'radiusFramedProtocol' DESC 'replyItem: Framed-Protocol' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.19 NAME 'radiusFramedRoute' DESC 'replyItem: Framed-Route' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.20 NAME 'radiusFramedRouting' DESC 'replyItem: Framed-Routing' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.46 NAME 'radiusGroupName' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.47 NAME 'radiusHint' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.48 NAME 'radiusHuntgroupName' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.21 NAME 'radiusIdleTimeout' DESC 'replyItem: Idle-Timeout' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.22 NAME 'radiusLoginIPHost' DESC 'replyItem: Login-IP-Host' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.23 NAME 'radiusLoginLATGroup' DESC 'replyItem: Login-LAT-Group' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.24 NAME 'radiusLoginLATNode' DESC 'replyItem: Login-LAT-Node' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.25 NAME 'radiusLoginLATPort' DESC 'replyItem: Login-LAT-Port' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.26 NAME 'radiusLoginLATService' DESC 'replyItem: Login-LAT-Service' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.27 NAME 'radiusLoginService' DESC 'replyItem: Login-Service' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.28 NAME 'radiusLoginTCPPort' DESC 'replyItem: Login-TCP-Port' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.29 NAME 'radiusPasswordRetry' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.30 NAME 'radiusPortLimit' DESC 'replyItem: Port-Limit' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.31 NAME 'radiusPrompt' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.49 NAME 'radiusProfileDN' EQUALITY distinguishedNameMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.50 NAME 'radiusProfileSuspendedDN' EQUALITY distinguishedNameMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.51 NAME 'radiusProxyToRealm' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.52 NAME 'radiusRealm' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.32 NAME 'radiusServiceType' DESC 'replyItem: Service-Type' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.33 NAME 'radiusSessionTimeout' DESC 'replyItem: Session-Timeout' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.34 NAME 'radiusTerminationAction' DESC 'replyItem: Termination-Action' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.35 NAME 'radiusTunnelAssignmentId' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.36 NAME 'radiusTunnelMediumType' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.37 NAME 'radiusTunnelPassword' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.38 NAME 'radiusTunnelPreference' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.39 NAME 'radiusTunnelPrivateGroupId' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.40 NAME 'radiusTunnelServerEndpoint' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.41 NAME 'radiusTunnelType' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.42 NAME 'radiusVSA' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.43 NAME 'radiusTunnelClientEndpoint' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.53 NAME 'radiusSimultaneousUse' DESC 'controlItem: Simultaneous-Use' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.54 NAME 'radiusLoginTime' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.55 NAME 'radiusUserCategory' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.56 NAME 'radiusStripUserName' SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.57 NAME 'dialupAccess' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.58 NAME 'radiusExpiration' DESC 'controlItem: Expiration' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.59 NAME 'radiusAttribute' DESC 'controlItem: $GENERIC$' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.61 NAME 'radiusNASIpAddress' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.62 NAME 'radiusReplyMessage' DESC 'replyItem: Reply-Message' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.97 NAME 'radiusFramedIPv6Prefix' DESC 'replyItem: Framed-IPv6-Prefix' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.168 NAME 'radiusFramedIPv6Address' DESC 'replyItem: Framed-IPv6-Address' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.169 NAME 'radiusDNSServerIPv6Address' DESC 'replyItem: DNS-Server-IPv6-Address' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.170 NAME 'radiusRouteIPv6Information' DESC 'replyItem: Route-IPv6-Information' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.171 NAME 'radiusDelegatedIPv6PrefixPool' DESC 'replyItem: Delegated-IPv6-Prefix-Pool' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.172 NAME 'radiusStatefulIPv6AddressPool' DESC 'replyItem: Stateful-IPv6-Address-Pool' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.256 NAME 'radiusControlAttribute' DESC 'controlItem: $GENERIC$' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.257 NAME 'radiusReplyAttribute' DESC 'replyItem: $GENERIC$' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.258 NAME 'radiusRequestAttribute' DESC 'requestItem: $GENERIC$' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.259 NAME 'radiusProfilePriority' DESC 'Priority to apply profiles' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 EQUALITY integerMatch ORDERING integerOrderingMatch SINGLE-VALUE ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.260 NAME 'radiusProfileCondition' DESC 'Condition to apply profiles' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.261 NAME 'radiusProfileFallthrough' DESC 'Condition to apply additional profiles after this one' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.1.1.1 NAME 'radiusClientSecret' DESC 'Client Secret' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) |
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.1.1.2 NAME 'radiusClientRequireMa' DESC 'Require Message Authenticator' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE ) |
||||
olcObjectClasses: ( 1.3.6.1.4.1.11344.4.2.2.2.1 NAME 'radiusProfile' SUP top AUXILIARY MAY ( radiusArapFeatures $ radiusArapSecurity $ radiusArapZoneAccess $ radiusAuthType $ radiusCallbackId $ radiusCallbackNumber $ radiusCalledStationId $ radiusCallingStationId $ radiusClass $ radiusClientIPAddress $ radiusFilterId $ radiusFramedAppleTalkLink $ radiusFramedAppleTalkNetwork $ radiusFramedAppleTalkZone $ radiusFramedCompression $ radiusFramedIPAddress $ radiusFramedIPNetmask $ radiusFramedIPXNetwork $ radiusFramedMTU $ radiusFramedProtocol $ radiusAttribute $ radiusFramedRoute $ radiusFramedRouting $ radiusIdleTimeout $ radiusGroupName $ radiusHint $ radiusHuntgroupName $ radiusLoginIPHost $ radiusLoginLATGroup $ radiusLoginLATNode $ radiusLoginLATPort $ radiusLoginLATService $ radiusLoginService $ radiusLoginTCPPort $ radiusLoginTime $ radiusPasswordRetry $ radiusPortLimit $ radiusPrompt $ radiusProxyToRealm $ radiusRealm $ radiusServiceType $ radiusSessionTimeout $ radiusStripUserName $ radiusTerminationAction $ radiusTunnelClientEndpoint $ radiusProfileDN $ radiusProfileSuspendedDN $ radiusSimultaneousUse $ radiusTunnelAssignmentId $ radiusTunnelMediumType $ radiusTunnelPassword $ radiusTunnelPreference $ radiusTunnelPrivateGroupId $ radiusTunnelServerEndpoint $ radiusTunnelType $ radiusUserCategory $ radiusVSA $ radiusExpiration $ dialupAccess $ radiusNASIpAddress $ radiusReplyMessage $ radiusFramedIPv6Prefix $ radiusFramedIPv6Address $ radiusDNSServerIPv6Address $ radiusRouteIPv6Information $ radiusDelegatedIPv6PrefixPool $ radiusStatefulIPv6AddressPool $ radiusControlAttribute $ radiusReplyAttribute $ radiusRequestAttribute $ radiusProfilePriority $ radiusProfileCondition $ radiusProfileFallthrough ) ) |
||||
olcObjectClasses: ( 1.3.6.1.4.1.11344.4.2.1.2.1 NAME 'radiusClient' SUP top AUXILIARY MUST radiusClientSecret MAY radiusClientRequireMa ) |
||||
@ -0,0 +1,602 @@ |
||||
# |
||||
# radiusProfile should be added to a freeradiusPolicy, user/subscriber objects, groups, |
||||
# or any other object which has RADIUS attributes associated with it. |
||||
# |
||||
# 11344.4.2.2.[1|2] |
||||
# | | | | |_ .1 Profile attributes, .2 profile objects |
||||
# | | | |_ Profile |
||||
# | | |_ RADIUS |
||||
# | |_ LDAP Attributes |
||||
# |_ Vendor |
||||
# |
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.1 |
||||
NAME 'radiusArapFeatures' |
||||
EQUALITY caseIgnoreMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
SINGLE-VALUE |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.2 |
||||
NAME 'radiusArapSecurity' |
||||
EQUALITY caseIgnoreMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
SINGLE-VALUE |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.3 |
||||
NAME 'radiusArapZoneAccess' |
||||
EQUALITY caseIgnoreMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
SINGLE-VALUE |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.44 |
||||
NAME 'radiusAuthType' |
||||
DESC 'controlItem: Auth-Type' |
||||
EQUALITY caseIgnoreMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
SINGLE-VALUE |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.4 |
||||
NAME 'radiusCallbackId' |
||||
DESC 'replyItem: Callback-Id' |
||||
EQUALITY caseIgnoreMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
SINGLE-VALUE |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.5 |
||||
NAME 'radiusCallbackNumber' |
||||
DESC 'replyItem: Callback-Number' |
||||
EQUALITY caseIgnoreMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
SINGLE-VALUE |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.6 |
||||
NAME 'radiusCalledStationId' |
||||
DESC 'controlItem: Called-Station-Id' |
||||
EQUALITY caseIgnoreMatch |
||||
SUBSTR caseIgnoreSubstringsMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
SINGLE-VALUE |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.7 |
||||
NAME 'radiusCallingStationId' |
||||
DESC 'controlItem: Calling-Station-Id' |
||||
EQUALITY caseIgnoreMatch |
||||
SUBSTR caseIgnoreSubstringsMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
SINGLE-VALUE |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.8 |
||||
NAME 'radiusClass' |
||||
DESC 'replyItem: Class' |
||||
EQUALITY caseIgnoreMatch |
||||
SUBSTR caseIgnoreSubstringsMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.45 |
||||
NAME 'radiusClientIPAddress' |
||||
EQUALITY caseIgnoreMatch |
||||
SUBSTR caseIgnoreSubstringsMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
SINGLE-VALUE |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.9 |
||||
NAME 'radiusFilterId' |
||||
DESC 'replyItem: Filter-Id' |
||||
EQUALITY caseIgnoreMatch |
||||
SUBSTR caseIgnoreSubstringsMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.10 |
||||
NAME 'radiusFramedAppleTalkLink' |
||||
DESC 'replyItem: Framed-AppleTalk-Link' |
||||
EQUALITY caseIgnoreMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
SINGLE-VALUE |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.11 |
||||
NAME 'radiusFramedAppleTalkNetwork' |
||||
DESC 'replyItem: Framed-AppleTalk-Network' |
||||
EQUALITY caseIgnoreMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.12 |
||||
NAME 'radiusFramedAppleTalkZone' |
||||
DESC 'replyItem: Framed-AppleTalk-Zone' |
||||
EQUALITY caseIgnoreMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
SINGLE-VALUE |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.13 |
||||
NAME 'radiusFramedCompression' |
||||
DESC 'replyItem: Framed-Compression' |
||||
EQUALITY caseIgnoreMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.14 |
||||
NAME 'radiusFramedIPAddress' |
||||
DESC 'replyItem: Framed-IP-Address' |
||||
EQUALITY caseIgnoreMatch |
||||
SUBSTR caseIgnoreSubstringsMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
SINGLE-VALUE |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.15 |
||||
NAME 'radiusFramedIPNetmask' |
||||
DESC 'replyItem: Framed-IP-Netmask' |
||||
EQUALITY caseIgnoreMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
SINGLE-VALUE |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.16 |
||||
NAME 'radiusFramedIPXNetwork' |
||||
DESC 'replyItem: Framed-IPX-Network' |
||||
EQUALITY caseIgnoreMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
SINGLE-VALUE |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.17 |
||||
NAME 'radiusFramedMTU' |
||||
DESC 'replyItem: Framed-MTU' |
||||
EQUALITY caseIgnoreMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
SINGLE-VALUE |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.18 |
||||
NAME 'radiusFramedProtocol' |
||||
DESC 'replyItem: Framed-Protocol' |
||||
EQUALITY caseIgnoreMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
SINGLE-VALUE |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.19 |
||||
NAME 'radiusFramedRoute' |
||||
DESC 'replyItem: Framed-Route' |
||||
EQUALITY caseIgnoreMatch |
||||
SUBSTR caseIgnoreSubstringsMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.20 |
||||
NAME 'radiusFramedRouting' |
||||
DESC 'replyItem: Framed-Routing' |
||||
EQUALITY caseIgnoreMatch |
||||
SUBSTR caseIgnoreSubstringsMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
SINGLE-VALUE |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.46 |
||||
NAME 'radiusGroupName' |
||||
EQUALITY caseIgnoreMatch |
||||
SUBSTR caseIgnoreSubstringsMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.47 |
||||
NAME 'radiusHint' |
||||
EQUALITY caseIgnoreMatch |
||||
SUBSTR caseIgnoreSubstringsMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
SINGLE-VALUE |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.48 |
||||
NAME 'radiusHuntgroupName' |
||||
EQUALITY caseIgnoreMatch |
||||
SUBSTR caseIgnoreSubstringsMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.21 |
||||
NAME 'radiusIdleTimeout' |
||||
DESC 'replyItem: Idle-Timeout' |
||||
EQUALITY caseIgnoreMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
SINGLE-VALUE |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.22 |
||||
NAME 'radiusLoginIPHost' |
||||
DESC 'replyItem: Login-IP-Host' |
||||
EQUALITY caseIgnoreMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.23 |
||||
NAME 'radiusLoginLATGroup' |
||||
DESC 'replyItem: Login-LAT-Group' |
||||
EQUALITY caseIgnoreMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
SINGLE-VALUE |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.24 |
||||
NAME 'radiusLoginLATNode' |
||||
DESC 'replyItem: Login-LAT-Node' |
||||
EQUALITY caseIgnoreMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
SINGLE-VALUE |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.25 |
||||
NAME 'radiusLoginLATPort' |
||||
DESC 'replyItem: Login-LAT-Port' |
||||
EQUALITY caseIgnoreMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
SINGLE-VALUE |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.26 |
||||
NAME 'radiusLoginLATService' |
||||
DESC 'replyItem: Login-LAT-Service' |
||||
EQUALITY caseIgnoreMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
SINGLE-VALUE |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.27 |
||||
NAME 'radiusLoginService' |
||||
DESC 'replyItem: Login-Service' |
||||
EQUALITY caseIgnoreMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
SINGLE-VALUE |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.28 |
||||
NAME 'radiusLoginTCPPort' |
||||
DESC 'replyItem: Login-TCP-Port' |
||||
EQUALITY caseIgnoreMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
SINGLE-VALUE |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.29 |
||||
NAME 'radiusPasswordRetry' |
||||
EQUALITY caseIgnoreMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
SINGLE-VALUE |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.30 |
||||
NAME 'radiusPortLimit' |
||||
DESC 'replyItem: Port-Limit' |
||||
EQUALITY caseIgnoreMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
SINGLE-VALUE |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.31 |
||||
NAME 'radiusPrompt' |
||||
EQUALITY caseIgnoreMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
SINGLE-VALUE |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.49 |
||||
NAME 'radiusProfileDN' |
||||
EQUALITY distinguishedNameMatch |
||||
SUBSTR caseIgnoreSubstringsMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.50 |
||||
NAME 'radiusProfileSuspendedDN' |
||||
EQUALITY distinguishedNameMatch |
||||
SUBSTR caseIgnoreSubstringsMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.51 |
||||
NAME 'radiusProxyToRealm' |
||||
EQUALITY caseIgnoreMatch |
||||
SUBSTR caseIgnoreSubstringsMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
SINGLE-VALUE |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.52 |
||||
NAME 'radiusRealm' |
||||
EQUALITY caseIgnoreMatch |
||||
SUBSTR caseIgnoreSubstringsMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
SINGLE-VALUE |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.32 |
||||
NAME 'radiusServiceType' |
||||
DESC 'replyItem: Service-Type' |
||||
EQUALITY caseIgnoreMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
SINGLE-VALUE |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.33 |
||||
NAME 'radiusSessionTimeout' |
||||
DESC 'replyItem: Session-Timeout' |
||||
EQUALITY caseIgnoreMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
SINGLE-VALUE |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.34 |
||||
NAME 'radiusTerminationAction' |
||||
DESC 'replyItem: Termination-Action' |
||||
EQUALITY caseIgnoreMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
SINGLE-VALUE |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.35 |
||||
NAME 'radiusTunnelAssignmentId' |
||||
EQUALITY caseIgnoreMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.36 |
||||
NAME 'radiusTunnelMediumType' |
||||
EQUALITY caseIgnoreMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.37 |
||||
NAME 'radiusTunnelPassword' |
||||
EQUALITY caseIgnoreMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
SINGLE-VALUE |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.38 |
||||
NAME 'radiusTunnelPreference' |
||||
EQUALITY caseIgnoreMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.39 |
||||
NAME 'radiusTunnelPrivateGroupId' |
||||
EQUALITY caseIgnoreMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.40 |
||||
NAME 'radiusTunnelServerEndpoint' |
||||
EQUALITY caseIgnoreMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.41 |
||||
NAME 'radiusTunnelType' |
||||
EQUALITY caseIgnoreMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.42 |
||||
NAME 'radiusVSA' |
||||
EQUALITY caseIgnoreMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.43 |
||||
NAME 'radiusTunnelClientEndpoint' |
||||
EQUALITY caseIgnoreMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.53 |
||||
NAME 'radiusSimultaneousUse' |
||||
DESC 'controlItem: Simultaneous-Use' |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 |
||||
SINGLE-VALUE |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.54 |
||||
NAME 'radiusLoginTime' |
||||
EQUALITY caseIgnoreMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
SINGLE-VALUE |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.55 |
||||
NAME 'radiusUserCategory' |
||||
EQUALITY caseIgnoreMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
SINGLE-VALUE |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.56 |
||||
NAME 'radiusStripUserName' |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 |
||||
SINGLE-VALUE |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.57 |
||||
NAME 'dialupAccess' |
||||
EQUALITY caseIgnoreMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
SINGLE-VALUE |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.58 |
||||
NAME 'radiusExpiration' |
||||
DESC 'controlItem: Expiration' |
||||
EQUALITY caseIgnoreMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
SINGLE-VALUE |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.59 |
||||
NAME 'radiusAttribute' |
||||
DESC 'controlItem: $GENERIC$' |
||||
EQUALITY caseIgnoreMatch |
||||
SUBSTR caseIgnoreSubstringsMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.61 |
||||
NAME 'radiusNASIpAddress' |
||||
EQUALITY caseIgnoreMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
SINGLE-VALUE |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.62 |
||||
NAME 'radiusReplyMessage' |
||||
DESC 'replyItem: Reply-Message' |
||||
EQUALITY caseIgnoreMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.97 |
||||
NAME 'radiusFramedIPv6Prefix' |
||||
DESC 'replyItem: Framed-IPv6-Prefix' |
||||
EQUALITY caseIgnoreMatch |
||||
SUBSTR caseIgnoreSubstringsMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.168 |
||||
NAME 'radiusFramedIPv6Address' |
||||
DESC 'replyItem: Framed-IPv6-Address' |
||||
EQUALITY caseIgnoreMatch |
||||
SUBSTR caseIgnoreSubstringsMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.169 |
||||
NAME 'radiusDNSServerIPv6Address' |
||||
DESC 'replyItem: DNS-Server-IPv6-Address' |
||||
EQUALITY caseIgnoreMatch |
||||
SUBSTR caseIgnoreSubstringsMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.170 |
||||
NAME 'radiusRouteIPv6Information' |
||||
DESC 'replyItem: Route-IPv6-Information' |
||||
EQUALITY caseIgnoreMatch |
||||
SUBSTR caseIgnoreSubstringsMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.171 |
||||
NAME 'radiusDelegatedIPv6PrefixPool' |
||||
DESC 'replyItem: Delegated-IPv6-Prefix-Pool' |
||||
EQUALITY caseIgnoreMatch |
||||
SUBSTR caseIgnoreSubstringsMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.172 |
||||
NAME 'radiusStatefulIPv6AddressPool' |
||||
DESC 'replyItem: Stateful-IPv6-Address-Pool' |
||||
EQUALITY caseIgnoreMatch |
||||
SUBSTR caseIgnoreSubstringsMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.256 |
||||
NAME 'radiusControlAttribute' |
||||
DESC 'controlItem: $GENERIC$' |
||||
EQUALITY caseIgnoreMatch |
||||
SUBSTR caseIgnoreSubstringsMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.257 |
||||
NAME 'radiusReplyAttribute' |
||||
DESC 'replyItem: $GENERIC$' |
||||
EQUALITY caseIgnoreMatch |
||||
SUBSTR caseIgnoreSubstringsMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.258 |
||||
NAME 'radiusRequestAttribute' |
||||
DESC 'requestItem: $GENERIC$' |
||||
EQUALITY caseIgnoreMatch |
||||
SUBSTR caseIgnoreSubstringsMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.259 |
||||
NAME 'radiusProfilePriority' |
||||
DESC 'Priority to apply profiles' |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 |
||||
EQUALITY integerMatch |
||||
ORDERING integerOrderingMatch |
||||
SINGLE-VALUE |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.260 |
||||
NAME 'radiusProfileCondition' |
||||
DESC 'Condition to apply profiles' |
||||
EQUALITY caseIgnoreMatch |
||||
SUBSTR caseIgnoreSubstringsMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.261 |
||||
NAME 'radiusProfileFallthrough' |
||||
DESC 'Condition to apply additional profiles after this one' |
||||
EQUALITY caseIgnoreMatch |
||||
SUBSTR caseIgnoreSubstringsMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
) |
||||
|
||||
objectclass ( 1.3.6.1.4.1.11344.4.2.2.2.1 |
||||
NAME 'radiusProfile' |
||||
SUP top |
||||
AUXILIARY |
||||
MAY ( radiusArapFeatures $ radiusArapSecurity $ radiusArapZoneAccess $ radiusAuthType $ radiusCallbackId $ radiusCallbackNumber $ radiusCalledStationId $ radiusCallingStationId $ radiusClass $ radiusClientIPAddress $ radiusFilterId $ radiusFramedAppleTalkLink $ radiusFramedAppleTalkNetwork $ radiusFramedAppleTalkZone $ radiusFramedCompression $ radiusFramedIPAddress $ radiusFramedIPNetmask $ radiusFramedIPXNetwork $ radiusFramedMTU $ radiusFramedProtocol $ radiusAttribute $ radiusFramedRoute $ radiusFramedRouting $ radiusIdleTimeout $ radiusGroupName $ radiusHint $ radiusHuntgroupName $ radiusLoginIPHost $ radiusLoginLATGroup $ radiusLoginLATNode $ radiusLoginLATPort $ radiusLoginLATService $ radiusLoginService $ radiusLoginTCPPort $ radiusLoginTime $ radiusPasswordRetry $ radiusPortLimit $ radiusPrompt $ radiusProxyToRealm $ radiusRealm $ radiusServiceType $ radiusSessionTimeout $ radiusStripUserName $ radiusTerminationAction $ radiusTunnelClientEndpoint $ radiusProfileDN $ radiusProfileSuspendedDN $ radiusSimultaneousUse $ radiusTunnelAssignmentId $ radiusTunnelMediumType $ radiusTunnelPassword $ radiusTunnelPreference $ radiusTunnelPrivateGroupId $ radiusTunnelServerEndpoint $ radiusTunnelType $ radiusUserCategory $ radiusVSA $ radiusExpiration $ dialupAccess $ radiusNASIpAddress $ radiusReplyMessage $ radiusFramedIPv6Prefix $ radiusFramedIPv6Address $ radiusDNSServerIPv6Address $ radiusRouteIPv6Information $ radiusDelegatedIPv6PrefixPool $ radiusStatefulIPv6AddressPool $ radiusControlAttribute $ radiusReplyAttribute $ radiusRequestAttribute $ radiusProfilePriority $ radiusProfileCondition $ radiusProfileFallthrough ) |
||||
) |
||||
|
||||
# |
||||
# 11344.4.2.1.[1|2] |
||||
# | | | | |_ .1 Profile attributes, .2 profile objects |
||||
# | | | |_ Client |
||||
# | | |_ RADIUS |
||||
# | |_ LDAP Attributes |
||||
# |_ Vendor |
||||
# |
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.1.1.1 |
||||
NAME 'radiusClientSecret' |
||||
DESC 'Client Secret' |
||||
EQUALITY caseIgnoreMatch |
||||
SUBSTR caseIgnoreSubstringsMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 |
||||
SINGLE-VALUE |
||||
) |
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.1.1.2 |
||||
NAME 'radiusClientRequireMa' |
||||
DESC 'Require Message Authenticator' |
||||
EQUALITY booleanMatch |
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 |
||||
SINGLE-VALUE |
||||
) |
||||
|
||||
objectclass ( 1.3.6.1.4.1.11344.4.2.1.2.1 |
||||
NAME 'radiusClient' |
||||
SUP top |
||||
AUXILIARY |
||||
MUST ( radiusClientSecret ) |
||||
MAY ( radiusClientRequireMa ) |
||||
) |
||||
@ -0,0 +1,32 @@ |
||||
ARG from=debian:bookworm |
||||
FROM ${from} |
||||
ARG DEBIAN_FRONTEND=noninteractive |
||||
|
||||
# |
||||
# We need also curl to get the signing key |
||||
# |
||||
RUN apt-get update \ |
||||
&& apt-get install -y curl |
||||
|
||||
# |
||||
# Set up NetworkRADIUS extras repository |
||||
# |
||||
RUN install -d -o root -g root -m 0755 /etc/apt/keyrings \ |
||||
&& curl -o /etc/apt/keyrings/packages.networkradius.com.asc "https://packages.inkbridgenetworks.com/pgp/packages%40networkradius.com" \ |
||||
&& echo "deb [signed-by=/etc/apt/keyrings/packages.networkradius.com.asc] http://packages.networkradius.com/extras/debian/bookworm bookworm main" > /etc/apt/sources.list.d/networkradius-extras.list |
||||
|
||||
# |
||||
# Install from reposittory |
||||
# |
||||
RUN apt-get install -y freeradius \ |
||||
&& apt-get clean \ |
||||
&& rm -r /var/lib/apt/lists/* \ |
||||
&& ln -s /etc/freeradius /etc/raddb |
||||
|
||||
ADD ./raddb/* /etc/raddb/3.0/ |
||||
|
||||
WORKDIR / |
||||
|
||||
EXPOSE 1812/udp 1813/udp |
||||
ENTRYPOINT ["freeradius"] |
||||
CMD ["-X"] |
||||
@ -0,0 +1,694 @@ |
||||
# -*- text -*- |
||||
# |
||||
# $Id: bc879ccc20354d5d32afa1f8b4d10422d5184eab $ |
||||
|
||||
# |
||||
# Lightweight Directory Access Protocol (LDAP) |
||||
# |
||||
ldap { |
||||
# Note that this needs to match the name(s) in the LDAP server |
||||
# certificate, if you're using ldaps. See OpenLDAP documentation |
||||
# for the behavioral semantics of specifying more than one host. |
||||
# |
||||
# Depending on the libldap in use, server may be an LDAP URI. |
||||
# In the case of OpenLDAP this allows additional the following |
||||
# additional schemes: |
||||
# - ldaps:// (LDAP over SSL) |
||||
# - ldapi:// (LDAP over Unix socket) |
||||
# - ldapc:// (Connectionless LDAP) |
||||
server = 'ldap' |
||||
# server = 'ldap.rrdns.example.org' |
||||
# server = 'ldap.rrdns.example.org' |
||||
|
||||
# Port to connect on, defaults to 389, will be ignored for LDAP URIs. |
||||
# port = 389 |
||||
|
||||
# Administrator account for searching and possibly modifying. |
||||
# If using SASL + KRB5 these should be commented out. |
||||
# identity = 'cn=admin,dc=example,dc=org' |
||||
password = readonly |
||||
|
||||
# Unless overridden in another section, the dn from which all |
||||
# searches will start from. |
||||
base_dn = 'dc=bearns,dc=me' |
||||
|
||||
# |
||||
# You can run the 'ldapsearch' command line tool using the |
||||
# parameters from this module's configuration. |
||||
# |
||||
# ldapsearch -D ${identity} -w ${password} -h ${server} -b 'CN=user,${base_dn}' |
||||
# |
||||
# That will give you the LDAP information for 'user'. |
||||
# |
||||
# Group membership can be queried by using the above "ldapsearch" string, |
||||
# and adding "memberof" qualifiers. For ActiveDirectory, use: |
||||
# |
||||
# ldapsearch ... '(&(objectClass=user)(sAMAccountName=user)(memberof=CN=group,${base_dn}))' |
||||
# |
||||
# Where 'user' is the user as above, and 'group' is the group you are querying for. |
||||
# |
||||
|
||||
# |
||||
# SASL parameters to use for admin binds |
||||
# |
||||
# When we're prompted by the SASL library, these control |
||||
# the responses given, as well as the identity and password |
||||
# directives above. |
||||
# |
||||
# If any directive is commented out, a NULL response will be |
||||
# provided to cyrus-sasl. |
||||
# |
||||
# Unfortunately the only way to control Keberos here is through |
||||
# environmental variables, as cyrus-sasl provides no API to |
||||
# set the krb5 config directly. |
||||
# |
||||
# Full documentation for MIT krb5 can be found here: |
||||
# |
||||
# http://web.mit.edu/kerberos/krb5-devel/doc/admin/env_variables.html |
||||
# |
||||
# At a minimum you probably want to set KRB5_CLIENT_KTNAME. |
||||
# |
||||
sasl { |
||||
# SASL mechanism |
||||
# mech = 'PLAIN' |
||||
|
||||
# SASL authorisation identity to proxy. |
||||
# proxy = 'autz_id' |
||||
|
||||
# SASL realm. Used for kerberos. |
||||
# realm = 'example.org' |
||||
} |
||||
|
||||
# |
||||
# Generic valuepair attribute |
||||
# |
||||
|
||||
# If set, this will attribute will be retrieved in addition to any |
||||
# mapped attributes. |
||||
# |
||||
# Values should be in the format: |
||||
# <radius attr> <op> <value> |
||||
# |
||||
# Where: |
||||
# <radius attr>: Is the attribute you wish to create |
||||
# with any valid list and request qualifiers. |
||||
# <op>: Is any assignment operator (=, :=, +=, -=). |
||||
# <value>: Is the value to parse into the new valuepair. |
||||
# If the value is wrapped in double quotes it |
||||
# will be xlat expanded. |
||||
# valuepair_attribute = 'radiusAttribute' |
||||
|
||||
# |
||||
# Mapping of LDAP directory attributes to RADIUS dictionary attributes. |
||||
# |
||||
|
||||
# WARNING: Although this format is almost identical to the unlang |
||||
# update section format, it does *NOT* mean that you can use other |
||||
# unlang constructs in module configuration files. |
||||
# |
||||
# Configuration items are in the format: |
||||
# <radius attr> <op> <ldap attr> |
||||
# |
||||
# Where: |
||||
# <radius attr>: Is the destination RADIUS attribute |
||||
# with any valid list and request qualifiers. |
||||
# <op>: Is any assignment attribute (=, :=, +=, -=). |
||||
# <ldap attr>: Is the attribute associated with user or |
||||
# profile objects in the LDAP directory. |
||||
# If the attribute name is wrapped in double |
||||
# quotes it will be xlat expanded. |
||||
# |
||||
# Request and list qualifiers may also be placed after the 'update' |
||||
# section name to set defaults destination requests/lists |
||||
# for unqualified RADIUS attributes. |
||||
# |
||||
# Note: LDAP attribute names should be single quoted unless you want |
||||
# the name value to be derived from an xlat expansion, or an |
||||
# attribute ref. |
||||
update { |
||||
control:Password-With-Header += 'userPassword' |
||||
# control:NT-Password := 'ntPassword' |
||||
# reply:Reply-Message := 'radiusReplyMessage' |
||||
# reply:Tunnel-Type := 'radiusTunnelType' |
||||
# reply:Tunnel-Medium-Type := 'radiusTunnelMediumType' |
||||
# reply:Tunnel-Private-Group-ID := 'radiusTunnelPrivategroupId' |
||||
|
||||
# Where only a list is specified as the RADIUS attribute, |
||||
# the value of the LDAP attribute is parsed as a valuepair |
||||
# in the same format as the 'valuepair_attribute' (above). |
||||
control: += 'radiusControlAttribute' |
||||
request: += 'radiusRequestAttribute' |
||||
reply: += 'radiusReplyAttribute' |
||||
} |
||||
|
||||
# Set to yes if you have eDirectory and want to use the universal |
||||
# password mechanism. |
||||
# edir = no |
||||
|
||||
# Set to yes if you want to bind as the user after retrieving the |
||||
# Cleartext-Password. This will consume the login grace, and |
||||
# verify user authorization. |
||||
# edir_autz = no |
||||
|
||||
# LDAP "bind as user" configuration to check PAP passwords. |
||||
# |
||||
# Active Directory needs "bind as user", which can be done by |
||||
# adding the following "if" statement to the authorize {} section |
||||
# of the virtual server, after the "ldap" module. For |
||||
# example: |
||||
# |
||||
# ... |
||||
# ldap |
||||
# if ((ok || updated) && User-Password && !control:Auth-Type) { |
||||
# update { |
||||
# control:Auth-Type := ldap |
||||
# } |
||||
# } |
||||
# ... |
||||
# |
||||
# You will also need to uncomment the "Auth-Type LDAP" block in the |
||||
# "authenticate" section. |
||||
# |
||||
# This configuration is required because AD will not return the users |
||||
# "known good" password to FreeRADIUS. Instead, FreeRADIUS has to run |
||||
# "Auth-Type LDAP" in order to do an LDAP "bind as user", which will hand |
||||
# the user name / password to AD for verification. |
||||
# |
||||
|
||||
# |
||||
# Name of the attribute that contains the user DN. |
||||
# The default name is LDAP-UserDn. |
||||
# |
||||
# If you have multiple LDAP instances, you should |
||||
# change this configuration item to: |
||||
# |
||||
# ${.:instance}-LDAP-UserDn |
||||
# |
||||
# That change allows the modules to set their own |
||||
# User DN, and to not conflict with each other. |
||||
# |
||||
user_dn = "LDAP-UserDn" |
||||
|
||||
# |
||||
# User object identification. |
||||
# |
||||
user { |
||||
# Where to start searching in the tree for users |
||||
base_dn = "${..base_dn}" |
||||
|
||||
# Filter for user objects, should be specific enough |
||||
# to identify a single user object. |
||||
# |
||||
# For Active Directory, you should use |
||||
# "samaccountname=" instead of "uid=" |
||||
# |
||||
filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" |
||||
|
||||
# For Active Directory nested group, you should comment out the previous 'filter = ...' |
||||
# and use the below. Where 'group' is the group you are querying for. |
||||
# |
||||
# NOTE: The string '1.2.840.113556.1.4.1941' specifies LDAP_MATCHING_RULE_IN_CHAIN. |
||||
# This applies only to DN attributes. This is an extended match operator that walks |
||||
# the chain of ancestry in objects all the way to the root until it finds a match. |
||||
# This reveals group nesting. It is available only on domain controllers with |
||||
# Windows Server 2003 SP2 or Windows Server 2008 (or above). |
||||
# |
||||
# See: https://social.technet.microsoft.com/wiki/contents/articles/5392.active-directory-ldap-syntax-filters.aspx |
||||
# |
||||
# filter = "(&(objectClass=user)(sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})(memberOf:1.2.840.113556.1.4.1941:=cn=group,${..base_dn}))" |
||||
|
||||
# SASL parameters to use for user binds |
||||
# |
||||
# When we're prompted by the SASL library, these control |
||||
# the responses given. |
||||
# |
||||
# Any of the config items below may be an attribute ref |
||||
# or and expansion, so different SASL mechs, proxy IDs |
||||
# and realms may be used for different users. |
||||
sasl { |
||||
# SASL mechanism |
||||
# mech = 'PLAIN' |
||||
|
||||
# SASL authorisation identity to proxy. |
||||
# proxy = &User-Name |
||||
|
||||
# SASL realm. Used for kerberos. |
||||
# realm = 'example.org' |
||||
} |
||||
|
||||
# Search scope, may be 'base', 'one', sub' or 'children' |
||||
# scope = 'sub' |
||||
|
||||
# Server side result sorting |
||||
# |
||||
# A list of space delimited attributes to order the result |
||||
# set by, if the filter matches multiple objects. |
||||
# Only the first result in the set will be processed. |
||||
# |
||||
# If the attribute name is prefixed with a hyphen '-' the |
||||
# sorting order will be reversed for that attribute. |
||||
# |
||||
# If sort_by is set, and the server does not support sorting |
||||
# the search will fail. |
||||
# sort_by = '-uid' |
||||
|
||||
# If this is undefined, anyone is authorised. |
||||
# If it is defined, the contents of this attribute |
||||
# determine whether or not the user is authorised |
||||
# access_attribute = 'dialupAccess' |
||||
|
||||
# Control whether the presence of 'access_attribute' |
||||
# allows access, or denys access. |
||||
# |
||||
# If 'yes', and the access_attribute is present, or |
||||
# 'no' and the access_attribute is absent then access |
||||
# will be allowed. |
||||
# |
||||
# If 'yes', and the access_attribute is absent, or |
||||
# 'no' and the access_attribute is present, then |
||||
# access will not be allowed. |
||||
# |
||||
# If the value of the access_attribute is 'false', it |
||||
# will negate the result. |
||||
# |
||||
# e.g. |
||||
# access_positive = yes |
||||
# access_attribute = userAccessAllowed |
||||
# |
||||
# With an LDAP object containing: |
||||
# userAccessAllowed: false |
||||
# |
||||
# Will result in the user being locked out. |
||||
# access_positive = yes |
||||
} |
||||
|
||||
# |
||||
# User membership checking. |
||||
# |
||||
group { |
||||
# Where to start searching in the tree for groups |
||||
base_dn = "${..base_dn}" |
||||
|
||||
# Filter for group objects, should match all available |
||||
# group objects a user might be a member of. |
||||
# |
||||
# If using Active Directory you are likely to need "group" |
||||
# instead of "posixGroup". |
||||
filter = '(objectClass=posixGroup)' |
||||
|
||||
# Search scope, may be 'base', 'one', sub' or 'children' |
||||
# scope = 'sub' |
||||
|
||||
# Attribute that uniquely identifies a group. |
||||
# Is used when converting group DNs to group |
||||
# names. |
||||
# name_attribute = cn |
||||
|
||||
# Filter to find all group objects a user is a member of. |
||||
# That is, group objects with attributes that |
||||
# identify members (the inverse of membership_attribute). |
||||
# |
||||
# Note that this configuration references the "user_dn" |
||||
# configuration defined above. |
||||
# |
||||
# membership_filter = "(|(member=%{control:${..user_dn}})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))" |
||||
|
||||
# The attribute, in user objects, which contain the names |
||||
# or DNs of groups a user is a member of. |
||||
# |
||||
# Unless a conversion between group name and group DN is |
||||
# needed, there's no requirement for the group objects |
||||
# referenced to actually exist. |
||||
# |
||||
# If the LDAP server does not support the "memberOf" |
||||
# attribute (or equivalent), then you will need to use the |
||||
# membership_filter option above instead. If you can't see |
||||
# the memberOf attribute then it is also possible that the |
||||
# LDAP bind user does not have the correct permissions to |
||||
# view it. |
||||
membership_attribute = 'memberOf' |
||||
|
||||
# If cacheable_name or cacheable_dn are enabled, |
||||
# all group information for the user will be |
||||
# retrieved from the directory and written to LDAP-Group |
||||
# attributes appropriate for the instance of rlm_ldap. |
||||
# |
||||
# For group comparisons these attributes will be checked |
||||
# instead of querying the LDAP directory directly. |
||||
# |
||||
# This feature is intended to be used with rlm_cache. |
||||
# |
||||
# If you wish to use this feature, you should enable |
||||
# the type that matches the format of your check items |
||||
# i.e. if your groups are specified as DNs then enable |
||||
# cacheable_dn else enable cacheable_name. |
||||
# cacheable_name = 'no' |
||||
# cacheable_dn = 'no' |
||||
|
||||
# Override the normal cache attribute (<inst>-LDAP-Group or |
||||
# LDAP-Group if using the default instance) and create a |
||||
# custom attribute. This can help if multiple module instances |
||||
# are used in fail-over. |
||||
# cache_attribute = 'LDAP-Cached-Membership' |
||||
|
||||
# If the group being checked is specified as a name, but |
||||
# the user's groups are referenced by DN, and one of those |
||||
# group DNs is invalid, the whole group check is treated as |
||||
# invalid, and a negative result will be returned. |
||||
# When set to 'yes', this option ignores invalid DN |
||||
# references. |
||||
# allow_dangling_group_ref = 'no' |
||||
} |
||||
|
||||
# |
||||
# User profiles. RADIUS profile objects contain sets of attributes |
||||
# to insert into the request. These attributes are mapped using |
||||
# the same mapping scheme applied to user objects (the update section above). |
||||
# |
||||
profile { |
||||
# Filter for RADIUS profile objects |
||||
# filter = '(objectclass=radiusprofile)' |
||||
|
||||
# The default profile. This may be a DN or an attribute |
||||
# reference. |
||||
# To get old v2.2.x style behaviour, or to use the |
||||
# &User-Profile attribute to specify the default profile, |
||||
# set this to &control:User-Profile. |
||||
# default = 'cn=radprofile,dc=example,dc=org' |
||||
|
||||
# The LDAP attribute containing profile DNs to apply |
||||
# in addition to the default profile above. These are |
||||
# retrieved from the user object, at the same time as the |
||||
# attributes from the update section, are are applied |
||||
# if authorization is successful. |
||||
# attribute = 'radiusProfileDn' |
||||
} |
||||
|
||||
# |
||||
# Bulk load clients from the directory |
||||
# |
||||
client { |
||||
# Where to start searching in the tree for clients |
||||
base_dn = "${..base_dn}" |
||||
|
||||
# |
||||
# Filter to match client objects |
||||
# |
||||
filter = '(objectClass=radiusClient)' |
||||
|
||||
# Search scope, may be 'base', 'one', 'sub' or 'children' |
||||
# scope = 'sub' |
||||
|
||||
# |
||||
# Sets default values (not obtained from LDAP) for new client entries |
||||
# |
||||
template { |
||||
# login = 'test' |
||||
# password = 'test' |
||||
# proto = tcp |
||||
# require_message_authenticator = yes |
||||
|
||||
# Uncomment to add a home_server with the same |
||||
# attributes as the client. |
||||
# coa_server { |
||||
# response_window = 2.0 |
||||
# } |
||||
} |
||||
|
||||
# |
||||
# Client attribute mappings are in the format: |
||||
# <client attribute> = <ldap attribute> |
||||
# |
||||
# The following attributes are required: |
||||
# * ipaddr | ipv4addr | ipv6addr - Client IP Address. |
||||
# * secret - RADIUS shared secret. |
||||
# |
||||
# All other attributes usually supported in a client |
||||
# definition are also supported here. |
||||
# |
||||
# Schemas are available in doc/schemas/ldap for openldap and eDirectory |
||||
# |
||||
attribute { |
||||
ipaddr = 'radiusClientIdentifier' |
||||
secret = 'radiusClientSecret' |
||||
# shortname = 'radiusClientShortname' |
||||
# nas_type = 'radiusClientType' |
||||
# virtual_server = 'radiusClientVirtualServer' |
||||
# require_message_authenticator = 'radiusClientRequireMa' |
||||
} |
||||
} |
||||
|
||||
# Load clients on startup |
||||
# read_clients = no |
||||
|
||||
# |
||||
# Modify user object on receiving Accounting-Request |
||||
# |
||||
|
||||
# Useful for recording things like the last time the user logged |
||||
# in, or the Acct-Session-ID for CoA/DM. |
||||
# |
||||
# LDAP modification items are in the format: |
||||
# <ldap attr> <op> <value> |
||||
# |
||||
# Where: |
||||
# <ldap attr>: The LDAP attribute to add modify or delete. |
||||
# <op>: One of the assignment operators: |
||||
# (:=, +=, -=, ++). |
||||
# Note: '=' is *not* supported. |
||||
# <value>: The value to add modify or delete. |
||||
# |
||||
# WARNING: If using the ':=' operator with a multi-valued LDAP |
||||
# attribute, all instances of the attribute will be removed and |
||||
# replaced with a single attribute. |
||||
accounting { |
||||
reference = "%{tolower:type.%{Acct-Status-Type}}" |
||||
|
||||
type { |
||||
start { |
||||
update { |
||||
description := "Online at %S" |
||||
} |
||||
} |
||||
|
||||
interim-update { |
||||
update { |
||||
description := "Last seen at %S" |
||||
} |
||||
} |
||||
|
||||
stop { |
||||
update { |
||||
description := "Offline at %S" |
||||
} |
||||
} |
||||
} |
||||
} |
||||
|
||||
# |
||||
# Post-Auth can modify LDAP objects too |
||||
# |
||||
post-auth { |
||||
update { |
||||
description := "Authenticated at %S" |
||||
} |
||||
} |
||||
|
||||
# |
||||
# LDAP connection-specific options. |
||||
# |
||||
# These options set timeouts, keep-alives, etc. for the connections. |
||||
# |
||||
options { |
||||
# Control under which situations aliases are followed. |
||||
# May be one of 'never', 'searching', 'finding' or 'always' |
||||
# default: libldap's default which is usually 'never'. |
||||
# |
||||
# LDAP_OPT_DEREF is set to this value. |
||||
# dereference = 'always' |
||||
|
||||
# |
||||
# The following two configuration items control whether the |
||||
# server follows references returned by LDAP directory. |
||||
# They are mostly for Active Directory compatibility. |
||||
# If you set these to 'no', then searches will likely return |
||||
# 'operations error', instead of a useful result. |
||||
# |
||||
# 'rebind' causes any connections being established to follow |
||||
# referrals to be bound using the admin credentials defined |
||||
# for this module. If it is set to 'no' libldap will bind |
||||
# to those connections anonymously. |
||||
# |
||||
chase_referrals = yes |
||||
rebind = yes |
||||
|
||||
# SASL Security Properties (see SASL_SECPROPS in ldap.conf man page). |
||||
# Note - uncomment when using GSS-API sasl mechanism along with TLS |
||||
# encryption against Active-Directory LDAP servers (this disables |
||||
# sealing and signing at the GSS level as required by AD). |
||||
#sasl_secprops = 'noanonymous,noplain,maxssf=0' |
||||
|
||||
# Seconds to wait for LDAP query to finish. default: 20 |
||||
res_timeout = 10 |
||||
|
||||
# Seconds LDAP server has to process the query (server-side |
||||
# time limit). default: 20 |
||||
# |
||||
# LDAP_OPT_TIMELIMIT is set to this value. |
||||
srv_timelimit = 3 |
||||
|
||||
# Seconds to wait for response of the server. (network |
||||
# failures) default: 10 |
||||
# |
||||
# LDAP_OPT_NETWORK_TIMEOUT is set to this value. |
||||
net_timeout = 1 |
||||
|
||||
# LDAP_OPT_X_KEEPALIVE_IDLE |
||||
idle = 60 |
||||
|
||||
# LDAP_OPT_X_KEEPALIVE_PROBES |
||||
probes = 3 |
||||
|
||||
# LDAP_OPT_X_KEEPALIVE_INTERVAL |
||||
interval = 3 |
||||
|
||||
# ldap_debug: debug flag for LDAP SDK |
||||
# (see OpenLDAP documentation). Set this to enable |
||||
# huge amounts of LDAP debugging on the screen. |
||||
# You should only use this if you are an LDAP expert. |
||||
# |
||||
# default: 0x0000 (no debugging messages) |
||||
# Example:(LDAP_DEBUG_FILTER+LDAP_DEBUG_CONNS) |
||||
ldap_debug = 0x0028 |
||||
} |
||||
|
||||
# |
||||
# This subsection configures the tls related items |
||||
# that control how FreeRADIUS connects to an LDAP |
||||
# server. It contains all of the 'tls_*' configuration |
||||
# entries used in older versions of FreeRADIUS. Those |
||||
# configuration entries can still be used, but we recommend |
||||
# using these. |
||||
# |
||||
# Note that some distributions use NSS for libldap instead |
||||
# of OpenSSL. |
||||
# |
||||
# If you see something like this in the debug output: |
||||
# |
||||
# TLSMC: MozNSS compatibility interception begins. |
||||
# |
||||
# Then there is a problem. |
||||
# |
||||
# THIS LDAP INSTALLATION WILL NOT WORK WITH FREERADIUS. |
||||
# |
||||
# You MUST install fixed LDAP libraries which use OpenSSL. |
||||
# |
||||
# For more details, see: |
||||
# |
||||
# http://packages.networkradius.com |
||||
# |
||||
tls { |
||||
# Set this to 'yes' to use TLS encrypted connections |
||||
# to the LDAP database by using the StartTLS extended |
||||
# operation. |
||||
# |
||||
# The StartTLS operation is supposed to be |
||||
# used with normal ldap connections instead of |
||||
# using ldaps (port 636) connections |
||||
# start_tls = yes |
||||
|
||||
# ca_file = ${certdir}/cacert.pem |
||||
|
||||
# ca_path = ${certdir} |
||||
# certificate_file = /path/to/radius.crt |
||||
# private_key_file = /path/to/radius.key |
||||
# random_file = /dev/urandom |
||||
|
||||
# Certificate Verification requirements. Can be: |
||||
# 'never' (do not even bother trying) |
||||
# 'allow' (try, but don't fail if the certificate |
||||
# cannot be verified) |
||||
# 'demand' (fail if the certificate does not verify) |
||||
# 'hard' (similar to 'demand' but fails if TLS |
||||
# cannot negotiate) |
||||
# |
||||
# The default is libldap's default, which varies based |
||||
# on the contents of ldap.conf. |
||||
|
||||
# require_cert = 'demand' |
||||
|
||||
# |
||||
# Minimum TLS version to accept. We STRONGLY recommend |
||||
# setting this to "1.2" |
||||
# |
||||
# tls_min_version = "1.2" |
||||
} |
||||
|
||||
# As of v3, the 'pool' section has replaced the |
||||
# following v2 configuration items: |
||||
# |
||||
# ldap_connections_number |
||||
|
||||
# |
||||
# The connection pool is used to pool outgoing connections. |
||||
# |
||||
# When the server is not threaded, the connection pool |
||||
# limits are ignored, and only one connection is used. |
||||
pool { |
||||
# Connections to create during module instantiation. |
||||
# If the server cannot create specified number of |
||||
# connections during instantiation it will exit. |
||||
# Set to 0 to allow the server to start without the |
||||
# directory being available. |
||||
start = ${thread[pool].start_servers} |
||||
|
||||
# Minimum number of connections to keep open |
||||
min = ${thread[pool].min_spare_servers} |
||||
|
||||
# Maximum number of connections |
||||
# |
||||
# If these connections are all in use and a new one |
||||
# is requested, the request will NOT get a connection. |
||||
# |
||||
# Setting 'max' to LESS than the number of threads means |
||||
# that some threads may starve, and you will see errors |
||||
# like 'No connections available and at max connection limit' |
||||
# |
||||
# Setting 'max' to MORE than the number of threads means |
||||
# that there are more connections than necessary. |
||||
max = ${thread[pool].max_servers} |
||||
|
||||
# Spare connections to be left idle |
||||
# |
||||
# NOTE: Idle connections WILL be closed if "idle_timeout" |
||||
# is set. This should be less than or equal to "max" above. |
||||
spare = ${thread[pool].max_spare_servers} |
||||
|
||||
# Number of uses before the connection is closed |
||||
# |
||||
# 0 means "infinite" |
||||
uses = 0 |
||||
|
||||
# The number of seconds to wait after the server tries |
||||
# to open a connection, and fails. During this time, |
||||
# no new connections will be opened. |
||||
retry_delay = 30 |
||||
|
||||
# The lifetime (in seconds) of the connection |
||||
lifetime = 0 |
||||
|
||||
# Idle timeout (in seconds). A connection which is |
||||
# unused for this length of time will be closed. |
||||
idle_timeout = 60 |
||||
|
||||
# NOTE: All configuration settings are enforced. If a |
||||
# connection is closed because of 'idle_timeout', |
||||
# 'uses', or 'lifetime', then the total number of |
||||
# connections MAY fall below 'min'. When that |
||||
# happens, it will open a new connection. It will |
||||
# also log a WARNING message. |
||||
# |
||||
# The solution is to either lower the 'min' connections, |
||||
# or increase lifetime/idle_timeout. |
||||
} |
||||
} |
||||
@ -0,0 +1,209 @@ |
||||
# |
||||
# Configuration file for the rlm_files module. |
||||
# Please see rlm_files(5) manpage for more information. |
||||
# |
||||
# This file contains authentication security and configuration |
||||
# information for each user. Accounting requests are NOT processed |
||||
# through this file. Instead, see 'accounting', in this directory. |
||||
# |
||||
# The first field is the user's name and can be up to |
||||
# 253 characters in length. This is followed (on the same line) with |
||||
# the list of authentication requirements for that user. This can |
||||
# include password, comm server name, comm server port number, protocol |
||||
# type (perhaps set by the "hints" file), and huntgroup name (set by |
||||
# the "huntgroups" file). |
||||
# |
||||
# If you are not sure why a particular reply is being sent by the |
||||
# server, then run the server in debugging mode (radiusd -X), and |
||||
# you will see which entries in this file are matched. |
||||
# |
||||
# When an authentication request is received from the comm server, |
||||
# these values are tested. Only the first match is used unless the |
||||
# "Fall-Through" variable is set to "Yes". |
||||
# |
||||
# A special user named "DEFAULT" matches on all usernames. |
||||
# You can have several DEFAULT entries. All entries are processed |
||||
# in the order they appear in this file. The first entry that |
||||
# matches the login-request will stop processing unless you use |
||||
# the Fall-Through variable. |
||||
# |
||||
# Indented (with the tab character) lines following the first |
||||
# line indicate the configuration values to be passed back to |
||||
# the comm server to allow the initiation of a user session. |
||||
# This can include things like the PPP configuration values |
||||
# or the host to log the user onto. |
||||
# |
||||
# You can include another `users' file with `$INCLUDE users.other' |
||||
|
||||
# |
||||
# For a list of RADIUS attributes, and links to their definitions, |
||||
# see: http://www.freeradius.org/rfc/attributes.html |
||||
# |
||||
# Entries below this point are examples included in the server for |
||||
# educational purposes. They may be deleted from the deployed |
||||
# configuration without impacting the operation of the server. |
||||
# |
||||
|
||||
# Ldap auth |
||||
DEFAULT Auth-Type = ldap |
||||
|
||||
# |
||||
# Deny access for a specific user. Note that this entry MUST |
||||
# be before any other 'Auth-Type' attribute which results in the user |
||||
# being authenticated. |
||||
# |
||||
# Note that there is NO 'Fall-Through' attribute, so the user will not |
||||
# be given any additional resources. |
||||
# |
||||
#lameuser Auth-Type := Reject |
||||
# Reply-Message = "Your account has been disabled." |
||||
|
||||
# |
||||
# Deny access for a group of users. |
||||
# |
||||
# Note that there is NO 'Fall-Through' attribute, so the user will not |
||||
# be given any additional resources. |
||||
# |
||||
#DEFAULT Group == "disabled", Auth-Type := Reject |
||||
# Reply-Message = "Your account has been disabled." |
||||
# |
||||
|
||||
# |
||||
# This is a complete entry for "steve". Note that there is no Fall-Through |
||||
# entry so that no DEFAULT entry will be used, and the user will NOT |
||||
# get any attributes in addition to the ones listed here. |
||||
# |
||||
#steve Cleartext-Password := "testing" |
||||
# Service-Type = Framed-User, |
||||
# Framed-Protocol = PPP, |
||||
# Framed-IP-Address = 172.16.3.33, |
||||
# Framed-IP-Netmask = 255.255.255.0, |
||||
# Framed-Routing = Broadcast-Listen, |
||||
# Framed-Filter-Id = "std.ppp", |
||||
# Framed-MTU = 1500, |
||||
# Framed-Compression = Van-Jacobsen-TCP-IP |
||||
|
||||
# |
||||
# The canonical testing user which is in most of the |
||||
# examples. |
||||
# |
||||
#bob Cleartext-Password := "hello" |
||||
# Reply-Message := "Hello, %{User-Name}" |
||||
# |
||||
|
||||
# |
||||
# This is an entry for a user with a space in their name. |
||||
# Note the double quotes surrounding the name. If you have |
||||
# users with spaces in their names, you must also change |
||||
# the "filter_username" policy to allow spaces. |
||||
# |
||||
# See raddb/policy.d/filter, filter_username {} section. |
||||
# |
||||
#"John Doe" Cleartext-Password := "hello" |
||||
# Reply-Message = "Hello, %{User-Name}" |
||||
|
||||
# |
||||
# Dial user back and telnet to the default host for that port |
||||
# |
||||
#Deg Cleartext-Password := "ge55ged" |
||||
# Service-Type = Callback-Login-User, |
||||
# Login-IP-Host = 0.0.0.0, |
||||
# Callback-Number = "9,5551212", |
||||
# Login-Service = Telnet, |
||||
# Login-TCP-Port = Telnet |
||||
|
||||
# |
||||
# Another complete entry. After the user "dialbk" has logged in, the |
||||
# connection will be broken and the user will be dialed back after which |
||||
# he will get a connection to the host "timeshare1". |
||||
# |
||||
#dialbk Cleartext-Password := "callme" |
||||
# Service-Type = Callback-Login-User, |
||||
# Login-IP-Host = timeshare1, |
||||
# Login-Service = PortMaster, |
||||
# Callback-Number = "9,1-800-555-1212" |
||||
|
||||
# |
||||
# user "swilson" will only get a static IP number if he logs in with |
||||
# a framed protocol on a terminal server in Alphen (see the huntgroups file). |
||||
# |
||||
# Note that by setting "Fall-Through", other attributes will be added from |
||||
# the following DEFAULT entries |
||||
# |
||||
#swilson Service-Type == Framed-User, Huntgroup-Name == "alphen" |
||||
# Framed-IP-Address = 192.0.2.65, |
||||
# Fall-Through = Yes |
||||
|
||||
# |
||||
# If the user logs in as 'username.shell', then authenticate them |
||||
# using the default method, give them shell access, and stop processing |
||||
# the rest of the file. |
||||
# |
||||
#DEFAULT Suffix == ".shell" |
||||
# Service-Type = Login-User, |
||||
# Login-Service = Telnet, |
||||
# Login-IP-Host = your.shell.machine |
||||
|
||||
|
||||
# |
||||
# The rest of this file contains the several DEFAULT entries. |
||||
# DEFAULT entries match with all login names. |
||||
# Note that DEFAULT entries can also Fall-Through (see first entry). |
||||
# A name-value pair from a DEFAULT entry will _NEVER_ override |
||||
# an already existing name-value pair. |
||||
# |
||||
|
||||
# Sample defaults for all framed connections. |
||||
# |
||||
#DEFAULT Service-Type == Framed-User |
||||
# Framed-IP-Address = 255.255.255.254, |
||||
# Framed-MTU = 576, |
||||
# Service-Type = Framed-User, |
||||
# Fall-Through = Yes |
||||
|
||||
# |
||||
# Default for PPP: dynamic IP address, PPP mode, VJ-compression. |
||||
# NOTE: we do not use Hint = "PPP", since PPP might also be auto-detected |
||||
# by the terminal server in which case there may not be a "P" suffix. |
||||
# The terminal server sends "Framed-Protocol = PPP" for auto PPP. |
||||
# |
||||
DEFAULT Framed-Protocol == PPP |
||||
Framed-Protocol = PPP, |
||||
Framed-Compression = Van-Jacobson-TCP-IP |
||||
|
||||
# |
||||
# Default for CSLIP: dynamic IP address, SLIP mode, VJ-compression. |
||||
# |
||||
DEFAULT Hint == "CSLIP" |
||||
Framed-Protocol = SLIP, |
||||
Framed-Compression = Van-Jacobson-TCP-IP |
||||
|
||||
# |
||||
# Default for SLIP: dynamic IP address, SLIP mode. |
||||
# |
||||
DEFAULT Hint == "SLIP" |
||||
Framed-Protocol = SLIP |
||||
|
||||
# |
||||
# Last default: rlogin to our main server. |
||||
# |
||||
#DEFAULT |
||||
# Service-Type = Login-User, |
||||
# Login-Service = Rlogin, |
||||
# Login-IP-Host = shellbox.ispdomain.com |
||||
|
||||
# # |
||||
# # Last default: shell on the local terminal server. |
||||
# # |
||||
# DEFAULT |
||||
# Service-Type = Administrative-User |
||||
|
||||
|
||||
# On no match, the user is denied access. |
||||
|
||||
|
||||
######################################################### |
||||
# You should add test accounts to the TOP of this file! # |
||||
# See the example user "bob" above. # |
||||
######################################################### |
||||
|
||||
@ -0,0 +1 @@ |
||||
../mods-available/ldap |
||||
File diff suppressed because it is too large
Load Diff
Loading…
Reference in new issue