ldap filter depending on NAS

[tnt at kalik.net]

> No, I have set them up  to checkItems:
> checkItem       Tunnel-Type:0                   radiusTunnelType
> checkItem       Tunnel-Medium-Type:0            radiusTunnelMediumType
> checkItem       Tunnel-Private-Group-Id:0       radiusTunnelPrivateGroupId
>

And what is the point of that? Why do you care what VLAN is in the
request? You should set up VLAN in the reply. Also, checking NAS-Port
makes very little sense. NAS-Port has a role in accounting but it's of
very little use during authentication. Mac (Calling-Station-Id) is the
only thing worth checking.

Don't bother with checking tunnel attributes - use them just in the reply.

Ivan Kalik
Kalik Informatika ISP