Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
IPA can be used as an authentication oracle for freeRADIUS but the setup is tricky.
You have to use: EAP-TTLS as an outer tunnel, PAP as an inner tunnel and configure freeRADIUS to do bind operation against IPA as if it is an LDAP server. You can use pam for that if you want, with SSSD you might get offline caching if you connection between RADIUS host and IPA might be disrupted, but if they are on the same box or connection is reliable it might make sense to use direct ldap bind rather than use the PAM stack. Also the ntlm method might be usable when we are done with Cross Realm Kerberos Trust in v3.
http://deployingradius.com/documents/protocols/oracles.htmlhttp://deployingradius.com/documents/protocols/compatibility.html
It would be nice to have a "drop replace" configuration, i.e. if you switch RADIUS server from AD to IPA. In this case you migrated or synced your users to IPA from AD and then you should be able to easily tweak the RADIUS config to point to IPA.
We should have something like this (but I do not think we need samba it seems that it should be simpler):
http://deployingradius.com/documents/configuration/active_directory.html
This part needs to be investigated. And not a high priority.
Comment 1RHEL Program Management
2012-01-03 17:45:15 UTC
Development Management has reviewed and declined this request. You may appeal
this decision by reopening this request.