Wireless/Redundant Edge Services xl Module Management and Configuration Guide WS.02.xx and greater

11-23
RADIUS Server
RADIUS Authentication
These strings configure the internal RADIUS server to submit the user-
name without appending a domain name. Make sure that the attribute you
chose lists the username in this form.
8. In the Password Attribute field, specify the attribute that stores a user’s
password.
When looking up a user’s account, the internal RADIUS server also
requests a check on the user’s password (or, depending on the EAP type,
a hash of that password). The string that you enter in the Password
Attribute field determines the attribute name that the server requests.
Match the attribute name used by your LDAP server—commonly “user-
Password” or “User-Password.”
9. In the Group Filter field, enter a filter string that searches for the groups to
which the users belongs.
This purpose of the group filter is to verify that the user is a member of
the group on the local RADIUS server that currently allows access.
An example of a group filter is:
&(objectClass=Group)(member=%{Ldap-UserDn}))
The first part of this filter tells the internal RADIUS server to search only
for group type objects. “Group” is one example of the name for this object
class. Other examples include:
• GroupOfUniqueNames
• GroupOfNames
The second part of the filter configures the internal RADIUS server to
search only for groups in which this user is a member. First enter the name
of the attribute that your LDAP server uses to list the members of a group.
In this example, that attribute is “member.” Another example is “unique-
member.” Next, set this attribute equal to this variable:
%{Ldap-UserDn}
This variable configures the module to submit the username as an LDAP
distinguished name. To create this name, the module adds the username
to the base distinguished name. For example:
cn=user,cn=Users,dn=mydomain,dn=com
Make sure that the name produced is the user’s correct distinguished
name.
The internal RADIUS server automatically adds this string to the filter:
(<group attribute>=<local group name>)