Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Currently have a FreeRADIUS 1.1.6 server authenticating users from OpenLDAP which are stored in the posixAccount account schema. We've now installed a Cisco WLC, and want to authenticate those users over 802.1X (which is successfully working), but also dynamically assign their computer onto a VLAN based on the MAC address of that computer (we're also using certificates, so the problems of MAC spoofing should be pretty much mitigated).

I've imported the radius schema into OpenLDAP, and have created a cn called dot1x, and based it on the objectClass radiusprofile - so we have an entry like this:

dn:cn=machine-1146,cn=dot1x,dc=org,dc=com
cn: machine-1146
radiusTunnelMediumType: IEEE-802
radiusTunnelType: VLAN
radiusTunnelPrivateGroupId: 600
objectClass: radiusprofile
objectClass: top

The questions are

  • Where in cn=dot1x,dc=org,dc=com do we put the MAC address of the machine?
  • How do I configure FreeRADIUS to search ou=people for user authentication, and then cn=dot1x for the computer MAC address, and then respond with the radiusTunnelPrivateGroupId?

Thanks for your help!

share|improve this question
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.