ProCurve 800, Configuration Manual

Page: 219 / 406

4-25
Configuring the RADIUS Server—Integrated with ProCurve Identity Driven Manager
Configure the NAC 800 as a RADIUS Server
The default filter is shown in Figure 4-6; it tells the NAC 800 to search for
an entry in which the “uid” attribute equals whatever username is submit-
ted in an authentication request. (The “Stripped-User-Domain” portion of
the filter allows the NAC 800 to remove an appended domain name, which
may be necessary to match the uid as stored in the directory.)
N o t e
Depending on how your directory is constructed, you might need to
change “uid” to “cn.”
The password attribute (default “userPassword”) must match the name
of the attribute that stores passwords in your directory. Remember the
OpenLDAP directory must allow the NAC 800 “auth” access to this
attribute.
N o t e
Be careful when altering the default settings: if you cause searches to fail,
you effectively lock out all users.
9. Check the
Use a secure connection (TLS)
box.
The NAC 800 and the OpenLDAP server perform a TLS handshake to
authenticate each other, as well as set up encryption keys to secure the
connection.
ProCurve Networking recommends that you always enable this option.
10. If you checked the box in the previous step, verify that the NAC 800 has
the proper certificate authority (CA) certificate.
The NAC 800 requires the CA certificate for the CA that signed the
OpenLDAP server’s certificate. Save this certificate on your management
station. Then click the
Browse button next to New certificate to upload
it to the NAC 800.
11. To verify that the NAC 800 can successfully bind to the OpenLDAP server,
click the test settings button.
See “Test Authentication Settings” on page 4-35 for more information on
setting up the test.
N o t e
You may receive a message that the test failed because the LDAP query
returned no results. Do not worry: although the search did not return any
results, the bind completed successfully. For information about other result
messages, see Table 4-2 on page 4-39.
12. You are now ready to specify your network’s NASs. (See “Add NASs as
802.1X Devices” on page 4-40.)