topic Re: Authenticating Users via LDAP (Active Directory) in Wireless

Authenticating Users via LDAP (Active Directory)

Lucas Phelps — Sat, 03 Jul 2021 23:57:12 GMT

I am attempting to secure our 'enterprise' WLAN with EAP security and would like it to check user's credentials via LDAP against our Active Directory database.

If using LDAP to authenticate, is there any reason to have a RADIUS server at all? If so, please elaborate.

Thanks for your guidance,

Lucas

Re: Authenticating Users via LDAP (Active Directory)

amritpatek — Mon, 19 Jan 2009 03:24:05 GMT

If any RADIUS servers are configured on the controller, the controller tries to authenticate the wireless clients using the RADIUS servers first. Local EAP is attempted only if no RADIUS servers are found, either because the RADIUS servers timed out or no RADIUS servers were configured. If four RADIUS servers are configured, the controller attempts to authenticate the client with the first RADIUS server, then the second RADIUS server, and then local EAP. If the client attempts to then reauthenticate manually, the controller tries the third RADIUS server, then the fourth RADIUS server, and then local EAP.

For the furter assistance following URL may help you

http://www.cisco.com/en/US/products/ps6366/products_configuration_example09186a008093f1b9.shtml

Re: Authenticating Users via LDAP (Active Directory)

Lucas Phelps — Mon, 02 Feb 2009 15:00:26 GMT

I guess I'm still left wondering whether I can just go into the LDAP configuration on the WLC and type the server info of my Active Directory server or whether I am required to have a RADIUS server.

RADIUS is an older, less secure method, and I'd rather have secure authentication directly to our LDAP AD server.

Re: Authenticating Users via LDAP (Active Directory)

r.roudi — Tue, 03 Feb 2009 05:59:31 GMT

Yes you can use LDAP with no RADIUS. However you should be aware of restrictions when using LDAP backend atabase authentication against LDAP. For instance, you will have to reconfigure your AD to return clear-text password.

Re: Authenticating Users via LDAP (Active Directory)

Lucas Phelps — Tue, 03 Feb 2009 14:39:04 GMT

But even with a RADIUS server, doesn't the password have to be clear-text?

I'm trying to figure out what the benefit is of having the required RADIUS server if I can hook the WLC directly up to LDAP on our Domain controllers.

Re: Authenticating Users via LDAP (Active Directory)

aneelaka — Fri, 06 Mar 2009 22:31:05 GMT

You need radius server, because you looking for protocol support such as PEAP, LEAP, EAP-TLS

Re: Authenticating Users via LDAP (Active Directory)

venom43212 — Tue, 10 Mar 2009 15:43:38 GMT

Enable IAS (microsfot's RADIUS) on one of your windows servers and set it to authenticate against AD.

Re: Authenticating Users via LDAP (Active Directory)

Robert.N.Barrett_2 — Thu, 02 Apr 2009 20:30:41 GMT

RADIUS communications are hashed with the Shared Secret, which is a poor excuse for encryption, but it keeps user credentials from rolling around in clear text format. Seems like you ought to be able to use IPSec to tighten up the comm between the controller and the RADIUS box.