Skip to main content
andygfunk
andygfunk
New Member
June 17, 2016
Question

Radius providing AD groupmembership

  • June 17, 2016
  • 1 reply
  • 10528 views

I have a problem I was hoping to get some help with. First some background.

 

We use Securenvoy for two factor authentication. Securenvoy is a quite limited radius server. We want to allow users to log on to ssl vpn with securenvoy providen second factor, while we limit permissions in the policy set with other ldap groups. 

 

So the user is member of one group which makes securenvoy to authenticate the user, and also one or more AD groups which are supposed to grant access to different parts of the network. We are hoping there is a possibility to pass back the username from radius and use this to populate firewall ldap groups. I don't know if this is making sense, but I'll continue anyhow.

 

We have tried to to do this with RSSO, but we have 3 problems with this approach:

1. Securenvoy is a limited radius server and does not support multiple network policies

2. Using NPS to forward radius request to securenvoy works, but I cannot get the accounting to work.

3. How will this work with user being member of multiple ad groups?

 

Our other SSL VPN solution from juniper solves this by using both Radius and LDAP in the authorization process. First it authenticates with radius, then checks ldap for group membership. We were hoping to do much the same here with one group to allow access to a tunnel based portal, and ad groups in firewall policies to grant access to networks. We can still use juniper, but I would like to get ridd of it to keep operational complexity at a minimum.

 

Hopefully someone can shed some light on this, and tell me if it is possible or not. 

 

Best regards

 

Andreas Grumheden

    1 reply

    emnoc
    emnoc
    New Member
    June 18, 2016

    I think you can still do what the juniper does. ( I'm just throwing this out never done it this way )

     

    1: setup a radius  auth server

     

    2: define a local user with  the "set type radius"  to match the radius server from step#1

     

     

    e.g

     

    config user local

       edit emnoc

             set type radius

             set radius-server "blahblahblah"

    end

     

    Then set  the  group to match on the LDAP-group mapping

     

     

    e.g

     

     

    config user group         edit "RoadWarriorGrp1"         set member "ldapsrvr01"             config match                 edit 1                     set server-name "ldapsrvr01"                     set group-name "CN=RDWARl,CN=vpnusers,DC=1plus1eq2,DC=com"                 next             end     next

    What that should do is to allow for the  the radius for 1st auth and then query the ldap-server for  group-name.

     

    Not sure if 2nd factor is doable tho but the above should get you started in the right path.

     

     

     

    andygfunk
    andygfunkAuthor
    New Member
    June 19, 2016

    Thank you for taking the time.

     

    Sadly it does not seem to work. As soon as it hits the radius server it stops group matching:

    [left]fnbamd_auth.c[2250] fnbamd_auth_handle_radius_result-Skipping group matching fnbamd_fsm.c[820] find_matched_usr_grps-Skipped group matching[/left]

     

    I have so far only managed to radius authenticate with a firewall group, and not a user. When trying with a user I get fnbamd_framed_ip_delete_ip-Didn't delete IP 0.0.0.0; no IPs for vfid 4 which might be because of something I've done on the radius server.

     

    Would it be possible to combine radius authentication with FSSO agent on the domain controllers?

    emnoc
    emnoc
    New Member
    June 20, 2016

    I never heard of that FSS0+RADIUS, I'm really surprised that the suggestion did not work. So if you set the the type as a local user and then auth does the group mapping works for the ldap query ?

     

     

    Also did you do any diag test authserver  to see what happens.?

     

    e.g

     

    diag  test  authserver  radius <radius server> <username> < password>

     

    And the same but a ldap-search query?

     

    ken

    Terms & ConditionsAccessibility statement