Usando FreeRADIUS para autenticar no ActiveDirecotry

Olá amigos,
tive a necessidade de autenticar nossa rede wifi utilizando-se de nossa base de usuários do AD, então para isso utilizei o freeradius 1.1.3 do CentOS 5.


Editando os arquivos de configuração:

# vim clients.conf

client 10.0.0.1 {
        secret = senha
        shortname = AP_XXX
        nastype = other
}

# vim users

DEFAULT Auth-Type := "LDAP"

# vim eap.conf

        eap {
                default_eap_type = peap
                timer_expire     = 60
                ignore_unknown_eap_types = no
                cisco_accounting_username_bug = no

                md5 {
                }

                leap {
                }

                gtc {
                        auth_type = PAP
                }

tls {
     private_key_password = whatever
     private_key_file = /etc/raddb/certs/cert-srv.pem
     certificate_file = /etc/raddb/certs/cert-srv.pem
     CA_file = /etc/raddb/certs/demoCA/cacert.pem
     dh_file = /etc/raddb/certs/dh
     random_file = /etc/raddb/certs/random
     fragment_size = 1024
     check_crl = no
   }

   ttls {
      default_eap_type = md5
      copy_request_to_tunnel = no
      use_tunneled_reply = no
   }




                 peap {
                        default_eap_type = mschapv2
                }

                mschapv2 {
                }
        }

# vim radiusd.conf

modules {

...
      ldap {
                authtype = ldap
                server = "servidor.dominio.net"
                identity = "login@dominio.net"
                password = "S3nh@"
                basedn = "ou=Usuaurio,dc=dominio,dc=net"
                base_filter = "(objectclass=posixAccount)"
                base_filter = "(objectClass=person)"
                access_attr = "SamAccountName"

                filter = "(&(sAMAccountname=%{Stripped-User-Name:-%{User-Name}})(objectClass=person))"

                start_tls = no
                dictionary_mapping = ${raddbdir}/ldap.attrmap
                ldap_connections_number = 5
                timeout = 4
                timelimit = 3
                net_timeout = 1
        }

 ....
}


authorize {
        preprocess
        ldap
        eap
        chap
        mschap
        files
}

authenticate {
        Auth-Type PAP {
                pap
        }

        Auth-Type CHAP {
                chap
        }

        Auth-Type MS-CHAP {
                mschap
        }
        Auth-Type LDAP {
                ldap
        }
        unix
        eap
}