{"id":2656,"date":"2026-02-02T16:49:31","date_gmt":"2026-02-02T15:49:31","guid":{"rendered":"https:\/\/yellotab.se\/x056\/?p=2656"},"modified":"2026-02-02T18:00:06","modified_gmt":"2026-02-02T17:00:06","slug":"free-radius","status":"publish","type":"post","link":"https:\/\/yellotab.se\/x056\/2026\/02\/02\/free-radius\/","title":{"rendered":"Free Radius"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><strong>K\u00e4lla<\/strong>: <a href=\"https:\/\/www.freeradius.org\/about\/\">FreeRadius <\/a>| <a href=\"https:\/\/www.keycloak.org\/extensions\">Keycloak<\/a> |<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What is the difference between FreeRADIUS and LDAP?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Ja, det finns st\u00f6d f\u00f6r OIDC i detta sammanhang, men det beror p\u00e5 exakt vad du menar med &#8221;st\u00f6der&#8221;:&nbsp;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Keycloak som OIDC-provider:<\/strong>\u00a0Keycloak har\u00a0<a href=\"https:\/\/www.keycloak.org\/securing-apps\/oidc-layers\" target=\"_blank\" rel=\"noreferrer noopener\">inbyggt st\u00f6d f\u00f6r OpenID Connect<\/a>. Det betyder att du kan anv\u00e4nda Keycloak f\u00f6r att logga in i webbapplikationer som st\u00f6der OIDC, oavsett om du anv\u00e4nder RADIUS f\u00f6r n\u00e4tverket eller inte.<\/li>\n\n\n\n<li><strong>RADIUS-pluginet och OIDC:<\/strong>\u00a0Det popul\u00e4ra\u00a0keycloak-radius-plugin\u00a0st\u00f6der en funktion som kallas\u00a0<strong>Radius OIDC password<\/strong>. Detta g\u00f6r det m\u00f6jligt f\u00f6r anv\u00e4ndare att anv\u00e4nda OIDC-fl\u00f6den eller tokens i kombination med RADIUS-autentisering.<\/li>\n\n\n\n<li><strong>Identity Brokering:<\/strong>\u00a0Keycloak kan agera som en brygga och l\u00e5ta anv\u00e4ndare logga in via en\u00a0<em>annan<\/em>\u00a0extern OIDC-leverant\u00f6r (som Google eller Azure AD). RADIUS-pluginet kan sedan validera dessa anv\u00e4ndare n\u00e4r de f\u00f6rs\u00f6ker ansluta till n\u00e4tverket.\u00a0<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Kortfattat:<\/strong>&nbsp;Keycloak \u00e4r i grunden byggt p\u00e5 OIDC, och det mest anv\u00e4nda RADIUS-pluginet \u00e4r utvecklat f\u00f6r att dra nytta av just dessa moderna protokoll f\u00f6r att erbjuda funktioner som MFA och sessionshantering \u00e4ven f\u00f6r RADIUS-klienter.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">F\u00f6rs\u00f6ker du konfigurera en specifik tj\u00e4nst (som en\u00a0<strong>VPN<\/strong>\u00a0eller en\u00a0<strong>Brandv\u00e4gg<\/strong>) att anv\u00e4nda Keycloak via OIDC, eller vill du att\u00a0<strong>RADIUS-klienten<\/strong>\u00a0ska f\u00f6rst\u00e5 OIDC-tokens?<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Please be aware the&nbsp;<strong>FreeRADIUS is an AAA server, and LDAP is a database<\/strong>. This separation of roles means that FreeRADIUS supports multiple kinds of authentication protocols such as PAP , CHAP , MS-CHAP , etc. An LDAP database supports only one authentication method: &#8221;bind as user&#8221;.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Keycloak och FreeRADIUS&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><mark>integreras ofta f\u00f6r att f\u00f6rena modern webbaserad identitetshantering (IAM) med traditionell n\u00e4tverksautentisering f\u00f6r Wi-Fi, VPN och switchar<\/mark>.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Det finns tv\u00e5 huvudsakliga tillv\u00e4gag\u00e5ngss\u00e4tt f\u00f6r att f\u00e5 dem att samarbeta:&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">1. FreeRADIUS som brygga (Proxy)&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">I detta scenario agerar FreeRADIUS som front-end f\u00f6r n\u00e4tverksenheter men validerar anv\u00e4ndaruppgifterna mot Keycloak.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Metod:<\/strong>\u00a0FreeRADIUS konfigureras att anropa Keycloak via ett REST-anrop (t.ex. till Keycloaks token-endpoint) eller genom att anv\u00e4nda en modul som\u00a0<strong>pam-exec-oauth2<\/strong>f\u00f6r att verifiera anv\u00e4ndaren via OAuth2\/OpenID Connect.<\/li>\n\n\n\n<li><strong>F\u00f6rdel:<\/strong>\u00a0Du kan anv\u00e4nda FreeRADIUS fulla kraft f\u00f6r komplexa n\u00e4tverksprotokoll (som EAP-TLS eller MS-CHAPv2) samtidigt som anv\u00e4ndardatan centraliseras i Keycloak.\u00a0<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">2. Keycloak RADIUS Plugin (Inbyggt st\u00f6d)<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Det finns tredjeparts-plugins som l\u00e4gger till RADIUS-funktionalitet direkt i Keycloak-servern, vilket g\u00f6r en separat FreeRADIUS-installation \u00f6verfl\u00f6dig i vissa fall.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Popul\u00e4rt val:<\/strong>\u00a0keycloak-radius-plugin\u00a0av vzakharchenko.<\/li>\n\n\n\n<li><strong>Funktion:<\/strong>\u00a0Pluginet l\u00e5ter Keycloak lyssna p\u00e5 RADIUS-f\u00f6rfr\u00e5gningar (UDP-port 1812\/1813) och hantera autentisering direkt fr\u00e5n sin egen databas.<\/li>\n\n\n\n<li><strong>Begr\u00e4nsning:<\/strong>\u00a0Plugin-l\u00f6sningar st\u00f6der ofta inte alla avancerade EAP-metoder som en dedikerad FreeRADIUS-server g\u00f6r.\u00a0<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">J\u00e4mf\u00f6relse<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"table has-fixed-layout\"><tbody><tr><th class=\"has-text-align-left\" data-align=\"left\">Funktion&nbsp;<\/th><th class=\"has-text-align-left\" data-align=\"left\">FreeRADIUS + Keycloak<\/th><th class=\"has-text-align-left\" data-align=\"left\">Keycloak Radius Plugin<\/th><\/tr><tr><td><strong>Komplexitet<\/strong><\/td><td>H\u00f6gre (tv\u00e5 servrar att hantera)<\/td><td>L\u00e4gre (allt i ett)<\/td><\/tr><tr><td><strong>Protokollst\u00f6d<\/strong><\/td><td>Fullst\u00e4ndigt (EAP, MS-CHAP etc.)<\/td><td>Begr\u00e4nsat (fr\u00e4mst PAP\/MS-CHAPv2)<\/td><\/tr><tr><td><strong>Skalbarhet<\/strong><\/td><td>Mycket h\u00f6g f\u00f6r n\u00e4tverkstrafik<\/td><td>Beroende av Keycloaks prestanda<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Server f\u00f6r testing lokalt<\/h2>\n\n\n\n<figure class=\"wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio\"><div class=\"wp-block-embed__wrapper\">\n<iframe loading=\"lazy\" title=\"How to Setup a FreeRADIUS Server on EVE-NG | Ubuntu 24.04\" width=\"500\" height=\"281\" src=\"https:\/\/www.youtube.com\/embed\/Qhl_BgG-qB0?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen><\/iframe>\n<\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Inloggning via gateway<\/h2>\n\n\n\n<figure class=\"wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio\"><div class=\"wp-block-embed__wrapper\">\n<iframe loading=\"lazy\" title=\"How to Configure RADIUS Authentication on Juniper\" width=\"500\" height=\"281\" src=\"https:\/\/www.youtube.com\/embed\/qc5meEvafmA?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen><\/iframe>\n<\/div><\/figure>\n","protected":false},"excerpt":{"rendered":"<p>K\u00e4lla: FreeRadius | Keycloak | What is the difference between FreeRADIUS and LDAP? Ja, det finns st\u00f6d f\u00f6r OIDC i detta sammanhang, men det beror p\u00e5 exakt vad du menar med &#8221;st\u00f6der&#8221;:&nbsp; Kortfattat:&nbsp;Keycloak \u00e4r i grunden byggt p\u00e5 OIDC, och det mest anv\u00e4nda RADIUS-pluginet \u00e4r utvecklat f\u00f6r att dra nytta av just dessa moderna protokoll [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[1],"tags":[],"class_list":["post-2656","post","type-post","status-publish","format-standard","hentry","category-news"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/yellotab.se\/x056\/wp-json\/wp\/v2\/posts\/2656","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/yellotab.se\/x056\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/yellotab.se\/x056\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/yellotab.se\/x056\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/yellotab.se\/x056\/wp-json\/wp\/v2\/comments?post=2656"}],"version-history":[{"count":5,"href":"https:\/\/yellotab.se\/x056\/wp-json\/wp\/v2\/posts\/2656\/revisions"}],"predecessor-version":[{"id":2668,"href":"https:\/\/yellotab.se\/x056\/wp-json\/wp\/v2\/posts\/2656\/revisions\/2668"}],"wp:attachment":[{"href":"https:\/\/yellotab.se\/x056\/wp-json\/wp\/v2\/media?parent=2656"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/yellotab.se\/x056\/wp-json\/wp\/v2\/categories?post=2656"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/yellotab.se\/x056\/wp-json\/wp\/v2\/tags?post=2656"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}