SLAPD-PW-RADIUS(5)

NAME
slapd-pw-radius - Radius backend password module to slapd

SYNOPSIS
ETCDIR/slapd.conf

    moduleload pw-radius /path/to/radius.conf

DESCRIPTION

The pw-radius module to slapd(8) provides support for using a RADIUS infrastructure as backend to verify the password provided in Simple Bind operations to OpenLDAP.

It does so by providing an additional password scheme for use in slapd:

    {RADIUS}
        RADIUS password scheme

Unlike in other password schemes, the value following the scheme is not a - potentially hashed - password, but the name of the corresponding RADIUS user in the RADIUS infrastructure.

This value, together with the password used in the Simple Bind operation, will be sent to the RADIUS server for authentication.

If the RADIUS server successfully authenticates the user, then the password verification succeeds, resulting in the LDAP Bind operation's success.

Conversely, failed RADIUS authentications leads to failing LDAP Binds.

CONFIGURATION
The pw-radius module needs no configuration beyond the additional filename argument to slapd.conf(5)'s moduleload directive. This filename is expected to point to a valid radius.conf(5). file adhering to libradius(3).

After loading the module, the password scheme {RADIUS} will be recognised in values of the userPassword attribute.

NOTES
Owing to its construction, using the {RADIUS} scheme as argument to the password-hash option in slapd.conf(5) does not make much sense, because of the scheme's construction.

This also applies to the use of the {RADIUS} scheme in slappasswd or ldappasswd.

EXAMPLES
To indicate that Simple Bind operations shall use the RADIUS user johndoe when validating passwords against the RADIUS infrastructure, set a user's LDAP attribute userPassword to:

userPassword: {RADIUS}johndoe

LIMITATIONS
Due to the way the configuration is loaded (additional argument to slapd.conf's moduleload directive), this module cannot be used with table-driven configuration.

SEE ALSO
slapd.conf(5), libradius(3) ldap(3),

"OpenLDAP Administrator's Guide" (http://www.OpenLDAP.org/doc/admin/)

ACKNOWLEDGEMENTS
This manual page has been written by Peter Marschall.

OpenLDAP is developed and maintained by The OpenLDAP Project (http://www.openldap.org/). OpenLDAP is derived from University of Michigan LDAP 3.3 Release.