RADIUS - Revision history

Steve: /* Linking a network access controller to the Opendium system */ Add info about turning on interim updates on UniFi

2023-09-26T15:01:28Z

Linking a network access controller to the Opendium system: Add info about turning on interim updates on UniFi

← Older revision		Revision as of 16:01, 26 September 2023
Line 9:		Line 9:

	You can either configure the network access controller / wifi system to use the Opendium system's RADIUS authentication service, or a third party service such as Microsoft NPS. However, the network access controller / wifi system must be configured to send accounting data to the Opendium system's RADIUS accounting service, even if an alternate authentication service is used.		You can either configure the network access controller / wifi system to use the Opendium system's RADIUS authentication service, or a third party service such as Microsoft NPS. However, the network access controller / wifi system must be configured to send accounting data to the Opendium system's RADIUS accounting service, even if an alternate authentication service is used.

			Ensure that your network access controller is configured to send interim accounting updates. For Ubiquiti UniFi systems this is done by logging onto the controller, going to Settings -> Profiles -> Select Accounting Server, clicking Edit and ticking "Enable interim updates".

	Remember to set appropriate [[Web: Permissions & Limits#User identification\|User Identification]] profiles for your networks.		Remember to set appropriate [[Web: Permissions & Limits#User identification\|User Identification]] profiles for your networks.

Steve at 09:49, 12 October 2022

2022-10-12T09:49:46Z

← Older revision		Revision as of 10:49, 12 October 2022
Line 39:		Line 39:

	== Logs ==		== Logs ==
	There are no logs for RADIUS service itself, but the RADIUS accounting data can be found in the [[Accounting Reports]].		There are no logs for RADIUS service itself, but the RADIUS accounting data can be found in the [[Accounting: Reports]].

	[[Category:Product Manuals]]		[[Category:Product Manuals]]

Steve at 09:48, 12 October 2022

2022-10-12T09:48:33Z

← Older revision		Revision as of 10:48, 12 October 2022
Line 15:		Line 15:
	If the Opendium system is being used as a RADIUS authentication service, some dynamic attributes can be configured, which are applied based on the user that is connecting to the network. Note that these settings are chosen based on only the user name, as the user's IP address is not known at the time that they are being applied.		If the Opendium system is being used as a RADIUS authentication service, some dynamic attributes can be configured, which are applied based on the user that is connecting to the network. Note that these settings are chosen based on only the user name, as the user's IP address is not known at the time that they are being applied.

	These are heritable settings (see [[Group Inheritance]]). If you are not sure which settings would be applied to a user, look at the [[RADIUS Policy Modelling\|Policy Modelling]] report.		These are heritable settings (see [[Group Inheritance]]). If you are not sure which settings would be applied to a user, look at the [[RADIUS: Policy Modelling\|Policy Modelling]] report.

	===VLAN===		===VLAN===

Steve at 09:47, 12 October 2022

2022-10-12T09:47:23Z

← Older revision		Revision as of 10:47, 12 October 2022
Line 10:		Line 10:
	You can either configure the network access controller / wifi system to use the Opendium system's RADIUS authentication service, or a third party service such as Microsoft NPS. However, the network access controller / wifi system must be configured to send accounting data to the Opendium system's RADIUS accounting service, even if an alternate authentication service is used.		You can either configure the network access controller / wifi system to use the Opendium system's RADIUS authentication service, or a third party service such as Microsoft NPS. However, the network access controller / wifi system must be configured to send accounting data to the Opendium system's RADIUS accounting service, even if an alternate authentication service is used.

	Remember to set appropriate [[Web Permissions & Limits#User identification\|User Identification]] profiles for your networks.		Remember to set appropriate [[Web: Permissions & Limits#User identification\|User Identification]] profiles for your networks.

	==RADIUS authentication attributes==		==RADIUS authentication attributes==

Steve at 16:30, 11 October 2022

2022-10-11T16:30:37Z

← Older revision		Revision as of 17:30, 11 October 2022
Line 10:		Line 10:
	You can either configure the network access controller / wifi system to use the Opendium system's RADIUS authentication service, or a third party service such as Microsoft NPS. However, the network access controller / wifi system must be configured to send accounting data to the Opendium system's RADIUS accounting service, even if an alternate authentication service is used.		You can either configure the network access controller / wifi system to use the Opendium system's RADIUS authentication service, or a third party service such as Microsoft NPS. However, the network access controller / wifi system must be configured to send accounting data to the Opendium system's RADIUS accounting service, even if an alternate authentication service is used.

	Remember to set appropriate [[User Identification]] profiles for your networks.		Remember to set appropriate [[Web Permissions & Limits#User identification\|User Identification]] profiles for your networks.

	==RADIUS authentication attributes==		==RADIUS authentication attributes==

Steve: /* RADIUS authentication attributes */

2022-10-11T10:48:00Z

RADIUS authentication attributes

← Older revision		Revision as of 11:48, 11 October 2022
Line 30:		Line 30:

	Select the appropriate user group from the group tree, and on the ''Ruckus user groups'' row of the table ensure that "Inherit" isn't ticked and "Enabled" is ticked. Enter the appropriate configuration into the text box and click ''Save Configuration''.		Select the appropriate user group from the group tree, and on the ''Ruckus user groups'' row of the table ensure that "Inherit" isn't ticked and "Enabled" is ticked. Enter the appropriate configuration into the text box and click ''Save Configuration''.

			== Machine authentication ==
			Devices which are part of a Windows domain can be configured to authenticate themselves with the network as a machine, rather than a specific user.

			The [[RADIUS#RADIUS authentication attributes\|RADIUS authentication attributes]], such as dynamic VLAN assignments, will come from the ''Anonymous'' group. However, we recommend setting them on the ''Everyone'' group and allowing them to be inherited by ''Anonymous''.

			A device which is authenticated as a machine will be expected to behave as a workstation and authenticate with the web proxy using Kerberos single sign-on authentication.

	== Logs ==		== Logs ==
	There are no ~~accounting~~ logs for RADIUS service itself, but the RADIUS accounting data can be found in the [[Accounting Reports]].		There are no logs for RADIUS service itself, but the RADIUS accounting data can be found in the [[Accounting Reports]].

	[[Category:Product Manuals]]		[[Category:Product Manuals]]

Steve at 08:30, 11 October 2022

2022-10-11T08:30:22Z

← Older revision		Revision as of 09:30, 11 October 2022
Line 15:		Line 15:
	If the Opendium system is being used as a RADIUS authentication service, some dynamic attributes can be configured, which are applied based on the user that is connecting to the network. Note that these settings are chosen based on only the user name, as the user's IP address is not known at the time that they are being applied.		If the Opendium system is being used as a RADIUS authentication service, some dynamic attributes can be configured, which are applied based on the user that is connecting to the network. Note that these settings are chosen based on only the user name, as the user's IP address is not known at the time that they are being applied.

	If you are not sure which settings would be applied to a user, look at the [[RADIUS Policy Modelling\|Policy Modelling]] report.		These are heritable settings (see [[Group Inheritance]]). If you are not sure which settings would be applied to a user, look at the [[RADIUS Policy Modelling\|Policy Modelling]] report.

	===VLAN===		===VLAN===

Steve at 11:11, 10 October 2022

2022-10-10T11:11:21Z

← Older revision		Revision as of 12:11, 10 October 2022
Line 34:		Line 34:
	There are no accounting logs for RADIUS service itself, but the RADIUS accounting data can be found in the [[Accounting Reports]].		There are no accounting logs for RADIUS service itself, but the RADIUS accounting data can be found in the [[Accounting Reports]].

	[[~~:Category:Product Manuals\|~~Category:Product Manuals]]		[[Category:Product Manuals]]

Steve at 11:11, 10 October 2022

2022-10-10T11:11:01Z

← Older revision		Revision as of 12:11, 10 October 2022
Line 33:		Line 33:
	== Logs ==		== Logs ==
	There are no accounting logs for RADIUS service itself, but the RADIUS accounting data can be found in the [[Accounting Reports]].		There are no accounting logs for RADIUS service itself, but the RADIUS accounting data can be found in the [[Accounting Reports]].

			[[:Category:Product Manuals\|Category:Product Manuals]]

Steve at 11:09, 10 October 2022

2022-10-10T11:09:45Z

← Older revision		Revision as of 12:09, 10 October 2022
Line 14:		Line 14:
	==RADIUS authentication attributes==		==RADIUS authentication attributes==
	If the Opendium system is being used as a RADIUS authentication service, some dynamic attributes can be configured, which are applied based on the user that is connecting to the network. Note that these settings are chosen based on only the user name, as the user's IP address is not known at the time that they are being applied.		If the Opendium system is being used as a RADIUS authentication service, some dynamic attributes can be configured, which are applied based on the user that is connecting to the network. Note that these settings are chosen based on only the user name, as the user's IP address is not known at the time that they are being applied.

			If you are not sure which settings would be applied to a user, look at the [[RADIUS Policy Modelling\|Policy Modelling]] report.

	===VLAN===		===VLAN===
Line 28:		Line 30:

	Select the appropriate user group from the group tree, and on the ''Ruckus user groups'' row of the table ensure that "Inherit" isn't ticked and "Enabled" is ticked. Enter the appropriate configuration into the text box and click ''Save Configuration''.		Select the appropriate user group from the group tree, and on the ''Ruckus user groups'' row of the table ensure that "Inherit" isn't ticked and "Enabled" is ticked. Enter the appropriate configuration into the text box and click ''Save Configuration''.

			== Logs ==
			There are no accounting logs for RADIUS service itself, but the RADIUS accounting data can be found in the [[Accounting Reports]].