In order to authenticate WiFi clients I use a FreeRADIUS server configured to check for user credentials in an Active Directory environment. Currently all users with a valid account are authenticated but I want a specific set of users, configured in a group in the Active Directory, to be the only accounts allowed access.

How do I configure FreeRADIUS to allow a specific group defined in the Active directory to be accepted by the RADIUS server?

FreeRADIUS is installed on CentOS 6.5 and I do not use a MySQL server for my configuration.

  • Thanks and sorry for my short question. I have a WLAN. for authentication purposes I used FreeRADIUS and WPA2 Enterprise. Username and passwords are forwarded to Active Directory for authentication. My question is that I don't want all my Active Directory's user can access to the Network. How can I have Group e.g. "WiFiaccess" in Active Directory and after remembering users to that group, they can be able to connect to WiFi network.?
    – Debian
    Aug 18, 2014 at 16:32

1 Answer 1


Basically there are two steps to authenticate and authorize users using FreeRADIUS on an Active Directory:

The authorization part will give you more configuration possibilities will support matching on groups as

configured in your FreeRADIUS configuration. By default the group membership check is disabled by default.

You will need to enable it and configure the LDAP connection.

Make sure you use the ldap directive in the authorize stanza of the configuration, and not in the authenticate stanza. In the authenticate stanza ntlm_auth should be used.

After this is set up you will need to restrict the usage to specific users using the users config file:

DEFAULT Auth-Type = ntlm_auth, LDAP-Group = "myfavoriteusers"
  • 1
    As of 3.0.8 we also support linking directly to the wbclient library. This gives about a 30% performance increase over the ntlm_auth exec method. Apr 12, 2015 at 16:37
  • @ArranCudbard-Bell "...but it is less well tested" as the docs state.
    – DustWolf
    Sep 7, 2021 at 12:46
  • Which docs state that? Sep 7, 2021 at 13:24
  • @ArranCudbard-Bell it was part of the mschap file. It still says it in the default Ubuntu 22.04 install of freeradius (3.0.26). github.com/FreeRADIUS/freeradius-server/blob/… Aug 15, 2022 at 22:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .