Technology
Follow
Contact

WIFITECHBLOG

Wireless Solutions, Best Solutions For You !

Ads 468x60px

home
Motorola
Cisco
Draytek

LDAP Configuration in switch for Openldap:-

LDAP Server Config Details

__________________________

Primary LDAP Server configuration

IP Address : 192.168.0.245

Port : 389

Bind DN : cn=manager,o=symbol,c=INDIA

Base DN : o=symbol,C=INDIA

Password : 0 secret

Password Attribute : UserPassword

Group Name : cn

Group Membership Filter: (|(&(objectClass=groupofNames)(member=%{Ldap-Us

erDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))

Group Member Attr : radiusGroupName

Net timeout : 1 second(s)

Description of the Fields for LDAP configuration:

LDAP Server IP and Port:

The IP address of the server running openldap Service and the port number on which the active directory service is listening. Default port number is 389.

LDAP “Base DN” field:

The top level of the LDAP directory tree is the base, referred to as the "base DN". In the above example we are working the domain dn "o=symbol,c=

INDIA

". The format for BaseDN for the above example would be

Base DN = “o=symbol,C=INDIA”.

LDAP “Bind DN” and “Password” fields:

Allows the radius server to get bind to the openldap Directory using the administrator user name and password. In the above example the ‘manager’ is the user with administrative privileges in the domain and the password for the user “secret” will be configured in the Bind Password field. For the above example Active Directory snap shot in Figure 1

Bind DN = “cn=manager,o=symbol,c=INDIA”

Bind Password = “secret”

These fields (Base DN, Bind DN and Password) will be used by the radius server to log onto the active and search for the requested users within this base.

Group Membership Filter:

Specify a search criteria:

(|(&(objectClass=groupofNames)(member=%{Ldap-Us

erDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))

Here objectClass=groupofNames has been given since in the snap shot to we can see that the group sales’s object class is groupofNames.

The basic search is done based on the group and that is the reason one has to create the same group on the switch also and configure a wlan policy allowing that wlan.

Rest of all other fields:

Rest of all the fields are to be used as shown in the above table. These attributes will be used in searching the users within the base in openldap as mentioned by the Base DN field.

Comparison between the configuration for linux openldap and Windows Active directoy

For openldap:

User Login Filter : (uid=%{Stripped-User-Name:-%{User-Name}})

Whereas for Active directory it will be;

User Login Filter : (sAMAccountName=%{Stripped-User-Name:-%{User

-Name}})

For openldap:

Group Filter :

(|(&(objectClass=groupofNames)(member=%{Ldap-Us

erDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))

Whereas for Active directory it will be;

Group Filter:

(|(&(objectClass=group)(member=%{Ldap-UserDn

}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))

Things to be taken care on the switch configuration:

1. Configure the authentication data source as ldap with the following commands:

WS5100(config)#radius-server local

WS5100(config-radsrv)#authentication data-source ldap

2. Mark the authentication type on switch to “all” with the command;

WS5100(config)#radius-server local

WS5100(config-radsrv)#authentication eap-auth-type all

3. The user in the openldap is a member of group “sales”; configure a group on switch with same name sales and in wlan policy allow access to wlan which we have connected for that group.

WS5100(config)#radius-server local

WS5100(config-radsrv)#group sales

WS5100(config-radsrv-group)#policy wlan 1

4. Mark the authentication protocol.

WS5100(config)#wireless

WS5100(config-wireless)#wlan 1 radius authentication-protocol pap

Note: The parameters are set for Linux OPENLDAP service. Parameters may be different for other LDAP servers.