Commit 9787f8a9 authored by Jonathan Gazeley's avatar Jonathan Gazeley
Browse files

Add support for configuring LDAP natively

parent d515f272

README.md

+88 −0
Original line number Diff line number Diff line
@@ -17,6 +17,7 @@ 
       * [`freeradius::config`](#freeradiusconfig)

       * [`freeradius::dictionary`](#freeradiusdictionary)

       * [`freeradius::instantiate`](#freeradiusinstantiate)

       * [`freeradius::ldap`](#freeradiusldap)

       * [`freeradius::module`](#freeradiusmodule)

       * [`freeradius::policy`](#freeradiuspolicy)

       * [`freeradius::site`](#freeradiussite)
@@ -267,6 +268,93 @@ Instantiate a module that is not automatically instantiated. 
freeradius::instantiate { 'mymodule': }

```



#### `freeradius::ldap`



Configure LDAP support for FreeRADIUS



##### `identity`

LDAP account for searching the directory. Required.



##### `password`

Password for the `identity` account. Required.



##### `basedn`

Unless overridden in another section, the dn from which all searches will start from. Required.



##### `server`

Hostname of IP address of the LDAP server. Note that this needs to match the name(s) in the LDAP server

certificate, if you're using ldaps. Default: `localhost`



##### `port`

Port to connect to the LDAP server on. Default: `389`



##### `uses`

How many times the connection can be used before being re-established. This is useful for things

like load balancers, which may exhibit sticky behaviour without it. `0` is unlimited. Default: `0`



##### `idle`

Sets the idle time before keepalive probes are sent. Default `60`



This option may not be supported by your LDAP library. If this configuration entry appears in the

output of `radiusd -X` then it is supported. Otherwise, it is unsupported and changing it will do nothing.



##### `probes`

Sets the maximum number of keepalive probes TCP should send before dropping the connection. Default: `3`



This option may not be supported by your LDAP library. If this configuration entry appears in the

output of `radiusd -X` then it is supported. Otherwise, it is unsupported and changing it will do nothing.



##### `interval`

Setss the interval in seconds between individual keepalive probes. Default: `3`



This option may not be supported by your LDAP library. If this configuration entry appears in the

output of `radiusd -X` then it is supported. Otherwise, it is unsupported and changing it will do nothing.



##### `timeout`

Number of seconds to wait for LDAP query to finish. Default: `10`



##### `start`

Connections to create during module instantiation. If the server cannot create specified number of

connections during instantiation it will exit. Set to 0 to allow the server to start without the

directory being available. This option only works with FR3; setting it on FR2 will have no effect.

Default: `${thread[pool].start_servers}`



##### `min`

Minimum number of connections to keep open. This option only works with FR3; setting it on FR2 will have no effect.

Default: `${thread[pool].min_spare_servers}`



##### `max`

Maximum number of connections. Default: `${thread[pool].max_servers}`



##### `spare`

Spare connections to be left idle. This option only works with FR3; setting it on FR2 will have no effect.

Default: `${thread[pool].max_spare_servers}`



##### `starttls`

Set this to 'yes' to use TLS encrypted connections to the LDAP database by using the StartTLS extended operation.

The StartTLS operation is supposed to be used with normal ldap connections instead of using ldaps (port 636) connections



Default: `no`



##### `cafile`

Path to CA cert file for TLS



##### `certfile`

Path to cert file for TLS



##### `keyfile`

Path to key file for TLS



##### `requirecert`

Certificate Verification requirements. Choose from:

'never' (do not even bother trying)

'allow' (try, but don't fail if the certificate cannot be verified)

'demand' (fail if the certificate does not verify)

'hard'  (similar to 'demand' but fails if TLS cannot negotiate)



Default: `allow`





#### `freeradius::module`



Install a module from a flat file.

manifests/ldap.pp

0 → 100644
+77 −0
Original line number Diff line number Diff line 
# Configure LDAP support for FreeRADIUS

define freeradius::ldap (

  $identity,

  $password,

  $basedn,

  $server   = 'localhost',

  $port     = 389,

  $uses     = 0,

  $idle     = 60,

  $probes   = 3,

  $interval = 3,

  $timeout  = 10,

  $start    = '${thread[pool].start_servers}',

  $min      = '${thread[pool].min_spare_servers}',

  $max      = '${thread[pool].max_servers}',

  $spare    = '${thread[pool].max_spare_servers}',

  $ensure   = 'present',



  $starttls = 'no',

  $cafile   = '',

  $certfile = '',

  $keyfile = '',

  $requirecert = 'allow',



) {

  $fr_package          = $::freeradius::params::fr_package

  $fr_service          = $::freeradius::params::fr_service

  $fr_modulepath       = $::freeradius::params::fr_modulepath

  $fr_group            = $::freeradius::params::fr_group



  # Validate our inputs

  # Hostnames

  unless (is_domain_name($server) or is_ip_address($server)) {

    fail('$server must be a valid hostname or IP address')

  }



  # Fake booleans (FR uses yes/no instead of true/false)

  unless $starttls in ['yes', 'no'] {

    fail('$starttls must be yes or no')

  }



  # Validate multiple choice options

  unless $requirecert in ['never', 'allow', 'demand', 'hard'] {

    fail('$requirecert must be one of never, allow, demand, hard')

  }



  # Validate integers

  unless is_integer($port) {

    fail('$port must be an integer')

  }

  unless is_integer($uses) {

    fail('$uses must be an integer')

  }

  unless is_integer($idle) {

    fail('$idle must be an integer')

  }

  unless is_integer($probes) {

    fail('$probes must be an integer')

  }

  unless is_integer($interval) {

    fail('$interval must be an integer')

  }

  unless is_integer($timeout) {

    fail('$timeout must be an integer')

  }



  # Generate a module config, based on ldap.conf

  file { "${fr_modulepath}/${name}":

    ensure  => $ensure,

    mode    => '0640',

    owner   => 'root',

    group   => $fr_group,

    content => template("freeradius/ldap.fr${::freeradius_maj_version}.erb"),

    require => [Package[$fr_package], Group[$fr_group]],

    notify  => Service[$fr_service],

  }

}

templates/ldap.fr2.erb

0 → 100644
+197 −0
Original line number Diff line number Diff line 
# -*- text -*-

#

#  $Id$



# Lightweight Directory Access Protocol (LDAP)

#

#  This module definition allows you to use LDAP for

#  authorization and authentication.

#

#  See raddb/sites-available/default for reference to the

#  ldap module in the authorize and authenticate sections.

#

#  However, LDAP can be used for authentication ONLY when the

#  Access-Request packet contains a clear-text User-Password

#  attribute.  LDAP authentication will NOT work for any other

#  authentication method.

#

#  This means that LDAP servers don't understand EAP.  If you

#  force "Auth-Type = LDAP", and then send the server a

#  request containing EAP authentication, then authentication

#  WILL NOT WORK.

#

#  The solution is to use the default configuration, which does

#  work.

#

#  Setting "Auth-Type = LDAP" is ALMOST ALWAYS WRONG.  We

#  really can't emphasize this enough.

#	

ldap {

	#

	#  Note that this needs to match the name in the LDAP

	#  server certificate, if you're using ldaps.

	server = "<%= @server %>"

	#identity = "<%= @identity %>"

	#password = <%= @password %>

	basedn = "<%= @basedn %>"

	filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})"

	#base_filter = "(objectclass=radiusprofile)"



	#  How many connections to keep open to the LDAP server.

	#  This saves time over opening a new LDAP socket for

	#  every authentication request.

	ldap_connections_number = <%= @max %>



	#  How many times the connection can be used before

	#  being re-established. This is useful for things

	#  like load balancers, which may exhibit sticky

	#  behaviour without it. (0) is unlimited.

	max_uses = <%= @uses %>



	#  Port to connect on, defaults to 389. Setting this to

	#  636 will enable LDAPS if start_tls (see below) is not

	#  able to be used.

	#port = <%= @port %>



	# seconds to wait for LDAP query to finish. default: 20

	timeout = <%= @timeout %>



	#  seconds LDAP server has to process the query (server-side

	#  time limit). default: 20

	#

	#  LDAP_OPT_TIMELIMIT is set to this value.

	timelimit = 3



	#

	#  seconds to wait for response of the server. (network

	#   failures) default: 10

	#

	#  LDAP_OPT_NETWORK_TIMEOUT is set to this value.

	net_timeout = 1



	#

	#  This subsection configures the tls related items

	#  that control how FreeRADIUS connects to an LDAP

	#  server.  It contains all of the "tls_*" configuration

	#  entries used in older versions of FreeRADIUS.  Those

	#  configuration entries can still be used, but we recommend

	#  using these.

	#

	tls {

		# Set this to 'yes' to use TLS encrypted connections

		# to the LDAP database by using the StartTLS extended

		# operation.

		#			

		# The StartTLS operation is supposed to be

		# used with normal ldap connections instead of

		# using ldaps (port 636) connections

		start_tls = <%= @starttls %>



<% if @cafile %>		cacertfile	= <%= @cafile %><% end %>

		# cacertdir	= /path/to/ca/dir/

<% if @certfile %>		certfile	= <%= @certfile %><% end %>

<% if @keyfile %>		keyfile		= <%= @keyfile %><% end %>

		# randfile	= /path/to/rnd



		#  Certificate Verification requirements.  Can be:

		#    "never" (don't even bother trying)

		#    "allow" (try, but don't fail if the cerificate

		#		can't be verified)

		#    "demand" (fail if the certificate doesn't verify.)

		#

		#	The default is "allow"

		require_cert	= "<%= @requirecert %>"

	}



	# default_profile = "cn=radprofile,ou=dialup,o=My Org,c=UA"

	# profile_attribute = "radiusProfileDn"

	# access_attr = "dialupAccess"



	# Mapping of RADIUS dictionary attributes to LDAP

	# directory attributes.

	dictionary_mapping = ${confdir}/ldap.attrmap



	#  Set password_attribute = nspmPassword to get the

	#  user's password from a Novell eDirectory

	#  backend. This will work ONLY IF FreeRADIUS has been

	#  built with the --with-edir configure option.

	#

	#  See also the following links:

	#

	#  http://www.novell.com/coolsolutions/appnote/16745.html

	#  https://secure-support.novell.com/KanisaPlatform/Publishing/558/3009668_f.SAL_Public.html

	#

	#  Novell may require TLS encrypted sessions before returning

	#  the user's password.

	#

	# password_attribute = userPassword



	#  Un-comment the following to disable Novell

	#  eDirectory account policy check and intruder

	#  detection. This will work *only if* FreeRADIUS is

	#  configured to build with --with-edir option.

	#

	edir_account_policy_check = no



	#

	#  Group membership checking.  Disabled by default.

	#

	# groupname_attribute = cn

	# groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn})))"

	# groupmembership_attribute = radiusGroupName



	# compare_check_items = yes

	# do_xlat = yes

	# access_attr_used_for_allow = yes



	#

	#  The following two configuration items are for Active Directory

	#  compatibility.  If you see the helpful "operations error"

	#  being returned to the LDAP module, uncomment the next

	#  two lines.

	#

	# chase_referrals = yes

	# rebind = yes



	#

	#  By default, if the packet contains a User-Password,

	#  and no other module is configured to handle the

	#  authentication, the LDAP module sets itself to do

	#  LDAP bind for authentication.

	#

	#  THIS WILL ONLY WORK FOR PAP AUTHENTICATION.

	#

	#  THIS WILL NOT WORK FOR CHAP, MS-CHAP, or 802.1x (EAP). 

	#

	#  You can disable this behavior by setting the following

	#  configuration entry to "no".

	#

	#  allowed values: {no, yes}

	# set_auth_type = yes



	#  ldap_debug: debug flag for LDAP SDK

	#  (see OpenLDAP documentation).  Set this to enable

	#  huge amounts of LDAP debugging on the screen.

	#  You should only use this if you are an LDAP expert.

	#

	#	default: 0x0000 (no debugging messages)

	#	Example:(LDAP_DEBUG_FILTER+LDAP_DEBUG_CONNS)

	#ldap_debug = 0x0028 



	#

	#  Keepalive configuration.  This MAY NOT be supported by your

	#  LDAP library.  If these configuration entries appear in the

	#  output of "radiusd -X", then they are supported.  Otherwise,

	#  they are unsupported, and changing them will do nothing.

	#

	keepalive {

		# LDAP_OPT_X_KEEPALIVE_IDLE

		idle = <%= @idle %>



		# LDAP_OPT_X_KEEPALIVE_PROBES

		probes = <%= @probes %>



		# LDAP_OPT_X_KEEPALIVE_INTERVAL

		interval = <%= @interval %>

	}

}

templates/ldap.fr3.erb

0 → 100644
+598 −0

File added.

Preview size limit exceeded, changes collapsed.