Freeradius & edirectory

Question

Hi,
We want to create a wireless network. W'd like to authenticate the
accounts against a radius server, so we thought setting up a freeradius
server running on open enterprise server (linux).
I installed an open enterprise server and deselected all Novell products.
So NO edirectory, eguide, ifolder, etc.... Also I choose to skip CA
creation. We already have multiple edirectory 8.7.3.7 servers, where one
of these servers is the Master CA.
I assume we can also use this CA server? Anyone for proper documentation
about this?
I installed the radius npm on a netware server running Imanager 2.5 and
tried to extend the schema. This does not go well, because of a
conflicting class. I get the following error message :
Schema conflict detected. Conflict details: [ ObjectClass Name(OID):
rADIUSProfile(2.16.840.1.113719.1.39.42.2.0.10) Conflicts with Freeradius
Objectclass : radiusprofile(1.3.6.1.4.1.3317.4.3.2.1) ]
Would you like to continue extending the rest of the class(es) and
Attribute(s) ?
I do not want to delete the current 'RADIUS:Profile' class, but I still
want to use freeradius & eDirectory to integrate. What can be done about
this? Why is Novell using both classes, knowing that the freeradius schema
extension always conflicts with a current edirectory/nmas combination?
I hope someone can help me out. I can not find anything about this,
besides deleting classes, which we can't in our setup.
regards,
Fred Radon

Answer 1

I could be daft but I'm in the process of setting up freeradius on an
OES Suse 9 server which I integrated into our tree after a lot of
research. My impression was that in order for freeradius to authenticate
into the edirectory tree it needed to be installed on a
Linux(SuSe/Redhat) server that had eDirectory, OpenSSL and OpenLDAP
installed.
http://www.novell.com/documentation/...y.html#btuadmy
I had previously attempted to find a way to just authenticate against
NLDAP or integrate a linux box as a BDC into my PDC on my Netware 6.5
box. However, each of these attempts ended when I found documentation
saying that neither was possible.
Novell's site has a lot of documentation on integrating edirectory with
freeradius. I've listed one main document above but there are TIDs that
cover other details. If you find that it is possible to set up a Linux
server without having it integrated into the edirectory tree and
authenticate users against eidirectory please let me know.
If you don't need edit authentication take a look at Zeroshell which is
a bootable radius server based on freeradius with a simple web interface
for administration.
Thanks,
-Nyle
[email protected] wrote:
> Hi,
>
> We want to create a wireless network. W'd like to authenticate the
> accounts against a radius server, so we thought setting up a freeradius
> server running on open enterprise server (linux).
>
> I installed an open enterprise server and deselected all Novell products.
> So NO edirectory, eguide, ifolder, etc.... Also I choose to skip CA
> creation. We already have multiple edirectory 8.7.3.7 servers, where one
> of these servers is the Master CA.
> I assume we can also use this CA server? Anyone for proper documentation
> about this?
>
>
> I installed the radius npm on a netware server running Imanager 2.5 and
> tried to extend the schema. This does not go well, because of a
> conflicting class. I get the following error message :
>
> Schema conflict detected. Conflict details: [ ObjectClass Name(OID):
> rADIUSProfile(2.16.840.1.113719.1.39.42.2.0.10) Conflicts with Freeradius
> Objectclass : radiusprofile(1.3.6.1.4.1.3317.4.3.2.1) ]
> Would you like to continue extending the rest of the class(es) and
> Attribute(s) ?
>
> I do not want to delete the current 'RADIUS:Profile' class, but I still
> want to use freeradius & eDirectory to integrate. What can be done about
> this? Why is Novell using both classes, knowing that the freeradius schema
> extension always conflicts with a current edirectory/nmas combination?
>
> I hope someone can help me out. I can not find anything about this,
> besides deleting classes, which we can't in our setup.
>
> regards,
> Fred Radon
>
>
>