Help - Setup of Radius server with Google LDAP, Synology Radius Server and HP Instant On

[SirAlan]

Hi, any help would be much appreciated!

 

We are looking for an easier way for staff to join the school network using 'Sign in with Google' We are a Google workspace education school.

 

Unfortunately, Talk Straight/Schools Broadband radius services do not currently allow for Google/LDAP use.

 

We have a Synology device which includes a Radius Server (I understand this uses Free Radius)

 

I have been able to sync our Google users with Synology LDAP.

 

Is anyone is able to assist with the Radius server set in Synology and the settings for InstantOn, and then the requirements for mobile devices and laptops to connect to the network either via 'sign in with google' or their google username and passwords that would be much appreciated!

 

Or any other suggestions!

 

Thank you in advance!

 

 

[dhicks]

3 hours ago, SirAlan said:

the requirements for mobile devices and laptops to connect to the network either via 'sign in with google' or their google username and passwords that would be much appreciated!

 

By "connect to the network", do you mean for users (wirth their own devices) to be able to connect to your wired / wireless network? That's not something we implement, but we do implement our Windows machines logging on via Google's LDAP service using the pGina login handler:

 

http://pgina.org/

 

I found that we couldn't get pGina to connect to Google's LDAP service directly, so we have an intermidate stunnel server:

 

https://www.stunnel.org/

 

That might help you be able to use LDAP services. If what you mean is you want your school owned/managed Windows devices to be able to log in with Google credentials, then possibly what you want is GCPW, the Google login handler for Windows. There was an issue with login cookies not being passed through to Chrome once logged in, however that seems to hae now been fixed:

 

 

I'm a bit unsure as to whether GCPW supports USB-based 2FA keys (which we use), I haven't had a chance to test recently and our LDAP-based logins have proven pretty solid, so it's not something I've looked at recently.

[SirAlan]

Thank you.

 

Sorry if I was unclear, this is for users to be able to join our WiFi network.