nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

AD or Radius login for Admins on Zone Director 1100

unknown

Hi,

Is it possible to have a group of admins and do the ad or radius authentification for management?

I cant find nothing about this on the forums or the knowledgebase.

I've just found information about regular users but nothing for management.

Basically just a group of admins will be using their ad logins.

Could you point me into the right direction?

I am using ZD 1100 with 9.6 firmware.

Thnx!

Find more posts tagged with

Accepted answers

All comments

michael_brown_5

Yes that is possible. Check https://support.ruckuswireless.com/documents/357-zonedirector-release-9-6-user-guide/download on page 278 under the topic heading of "Using An External Server For Administrator Authentication".

I set this up a while back using AD and it works great. I still use Radius for 802.1x auth but LDAP for management auth. Also I can't remember 100% but I do not think you can do a group of a group. All your users will have to be added directly to your management group.

unknown

same problem.

always fail on step 4.

but even pass 4, how to assign one user or AD group into the an Administrator Role in ZoneDirector?

4. Test your authentication settings (Configure > AAA Servers > Test Authentication

Settings).

michael_brown_5

Are you doing LDAP or Radius? Failing the test for Radius is normal if you don't use PAP. I think it is in some random manual but I know I saw it in an old forum post here http://forums-archive.ruckuswireless.com/forums/6/topics/839

Once past step 4 you can go to "Roles" and create a new role and fill in the "Group Attributes" field with the group you want to tie to that role.

unknown

hi Miko,

could u provide a sample for me. i need sceen snapshot.

thank u very much!!!!

michael_brown_5

Hopefully this helps. Below is the LDAP stuff which I use for management of the ZD.

Image_ images_messages_5f91c409135b77e24792bdbd_b2a7d46cd2eca722067e33d85318bee7_aaa_inline-c5a57f39-1074-4fc7-993b-a3d7641096bd-509119758.png1387197064

Image_ images_messages_5f91c409135b77e24792bdbd_b2a7d46cd2eca722067e33d85318bee7_aaa_inline-c5a57f39-1074-4fc7-993b-a3d7641096bd-509119758.png1387197064

Image_ images_messages_5f91c409135b77e24792bdbd_b16ac217561cb0b9f49093a8bc471a4f_Roles_inline-3bf0e7d9-facf-4514-8b04-d5d6fceb2fc7-1014242870.png1387197075

unknown

"ZD admins" can be find in AD, right? then this group members are administrator.

i saw u use AD, but why said LDAP?

i'm very strange, why AD type needn't provide credential? is there anything should trust in AD?

michael_brown_5

Yes, "ZD Admins" is a group in AD that contains users who should have full admin access to the ZD. Sorry about using the term LDAP. We used to be a Novell shop and I am used to using the term LDAP interchangeably with AD but we are using AD in this case. There was no trust nessisary I just filled in the nessisary info and it works.

unknown

Miko,

very very thank you!

i test it and pass AD setting. i can use ad account logon.

but LDAP still cannot work, does ZD support LDAP user to logon? if yes, i think u have example too, could you share it?

(what's the UID in AD? samaccountname? CN ?) Image_ images_messages_5f91c40a135b77e24792daa5_af593a6e47e1989aa6b847d2b5362fb2_1_inline-f6ddec87-e30e-4515-8853-ddf3cab57987-636449635.JPG1387275976

Image_ images_messages_5f91c40a135b77e24792daa5_af593a6e47e1989aa6b847d2b5362fb2_1_inline-f6ddec87-e30e-4515-8853-ddf3cab57987-636449635.JPG1387275976

michael_brown_5

Your settings look good except maybe for the "Key Attribute". If you are using Active Directory it should be sAMAccountName which is what Windows would use to log people in to computers. You can use cn, that is the value that is shown in Users and Computers which may not be the same as their login.

I should mention that if you require SSL authentication via LDAP this may not work. Our AD servers do not require SSL for authentication but our OpenLDAP server does and I could not get it working with OpenLDAP even even by changing the port to 636.

unknown

Alguma informação sobre este tópico?
Estou tentando integrar via AD, mas estou perdido no Nome distinto do administrador e no Nome distinto da base, você poderia compartilhar como é a solicitação do AD e suas configurações de ZD?

unknown

Any information on this topic?

I'm trying to integrate via AD, but I'm lost in the Admin DistinguishedName, and in the Base DistinguishedName, could you share how the AD request is, and your ZD settings?

caesar_chen

i give up on this ,
i setup a NPS ,all smooth and i can test AAA with ruckus ,the test pass smoothly too
but when i login with real case ......it fails

unknown

I have the same problem for radius auth for admins into ZD. The manual doesn't say a word about assigning a user role, only groups... anyone figure this out?

EDIT: Apparently you have to match the names as in the photo above. Would be nice is this was spelled out a little more clearly. The group/role is basically the same for the Radius purposes, I guess.