ads questions and multiple values

[Phil Mayers]

liz wrote:
> What I would like to do is to have it be able to query the memberOf 
> attribute in the acrtive directory server and then verify if the user is 
> in any of those groups and than permit access based on that membership. 

The "memberOf" attribute (groups on the user entry) is supported by the 
"groupmembership_attribute" config item, which it seems from reading the 
code is ONLY consulted AFTER the searches for group objects returns no 
values. Since AD maintains the group objects and the memberOf in 
concert, you'll never reach there.

The "Ldap-Group" support allows you to check if a user is in a group at 
the server, and works like so (you probably know this):

DEFAULT Ldap-Group = "shortname"

Or:

DEFAULT Ldap-Group = "cn=shortname,ou=path,dc=domain,dc=com"

If you use the first form, the search that's done is:

base: standard LDAP baseDN
filter: cn=shortname AND (GROUPMEMBERSHIP_FILTER)

If you use the 2nd form, the search that's done is:

base: cn=shortname,ou=path,dc=domain,dc=com
filter: GROUPMEMBERSHIP_FILTER

GROUPMEMBERSHIP_FILTER being the config item of the same name in the 
radiusd.conf - in the case of AD, an appropriate config is:

groupmembership_filter = "(&(objectClass=group)(member=%{Ldap-UserDn}))"

As I say, only after those searches have been done and returned no 
entries is memberOf consulted, which will never happen for an AD LDAP 
server. But the results of looking up the group entry versus looking up 
memberOf on the user entry should be identical.

> Heres what im wondering
> 
> a) When I query the attribute it returns multiple cn=... results. In the 
> debug log I see it setting  this as xxx.xxxx which is understood by our 
> nas equipment. It does it four times, But in the reply packet I only see 
> it sending one and not four. Am I correct to assume that it will only 
> send one of the responses to the Nas.

I'm not sure I understand this part - could you expand on it? How are 
you putting the LDAP groups into the reply (that's not the normal 
use-case - you would normally do group-based checks at the server rather 
than the NAS, not that there's anything wrong with the latter)

> 
> b) I think I can use the Users file to determine which group the user is 
> a member of and then have it send an attribute back to the Nas telling 
> it which role to set. Is the the attribute returning multiple groups a 
> problem (not multiple attributes, one attribute several bits of data  
> seperated by a delimiter) ?

When doing LDAP group checks at the server side, you would normally have 
something like (examples using the long/DN form for group - you can just 
put the short name, see above):

DEFAULT Ldap-Group == "cn=nasadmin,dc=domain,dc=com"
	NAS-Role = "Administrator"

DEFAULT Ldap-Group == "cn=nasoper,dc=domain,dc=com"
         NAS-Role = "Operator"

DEFAULT Auth-Type := Reject
         Reply-Message = "You are not able to admin the NAS"

The fact the user may be in >1 group is not a problem - the LDAP search 
looks for the user and the group combination.

> 
> c) can I strip the leading cn= bit from the response the ldap server 
> sends ( I saw an article somewhere about using an operator in the 
> LDAP.attrmap file)  and once thats done can it use the groups returned 
> in the users file?

I'm not sure I understand this. The rlm_ldap module does not by default 
put the groups into the reply.

Via the "ldap.attrmap" entry you can put anything you like into the 
reply, but modifying the value that comes out of the LDAP server is 
non-trivial.

If you could describe more precisely what you're trying to do I may be 
able to give a more specific answer.