Authorizing using LDAP attributes

[Clayton Knorr]

Running radius 2.1.12 and Openldap (openldap just for testing at this point)

Ok, my situation in a nutshell.

Trying to solve a problem. Need to provide EAP authentication for wifi to many devices. The freeradius server will be hitting an LDAP directory which is not in my control. I need to be able to have conditional logic to allow only certain users with certain attributes in the LDAP directory connect to certain RADIUS clients. I don't control the LDAP directory so using groups or OUs is not an option. So for example if the ldap user has an attribute Location that equals "A1234" I only want them to connect to one or a subset of Aps/controllers.

I have gotten to the point where everything works for EAP, just the LDAP attributes mapping to RADIUS attributes is giving me fits.

So I have a test ldap directory in which I have set users up with the attribute businessCategory set to A1000.
I have added an entry to the main dictionary file: ATTRIBUTE       My-Local-String         3000    string
I have added a line to ldap.attrmap: checkItem       My-Local-String                 businessCategory
I have the following in my post-auth section in sites-enabled/default:

        if ( Called-Station-Id == "AC-85-75-46-55-91:Peep" && My-Local-String == "A1000" ) {
               noop
        }

        else {
                reject
        }

Here are some logs from what happens when I try to log in:
...
[ldap] looking for check items in directory...
  [ldap] businessCategory -> My-Local-String == "A1000"
  [ldap] userPassword -> Cleartext-Password == "password"
  [ldap] userPassword -> Password-With-Header == "password"
[ldap] looking for reply items in directory...
[ldap] user uuserton authorized to use remote access
  [ldap] ldap_release_conn: Release Id: 0
++[ldap] return
.....

# Executing section post-auth from file /etc/freeradius/sites-enabled/default
+- entering group post-auth {...}
++? if (Called-Station-Id == "AC-85-75-46-55-91:Peep" && My-Local-String == "A1000" )
? Evaluating (Called-Station-Id == "AC-86-74-46-65-91:Peep" ) -> TRUE
    (Attribute My-Local-String was not found)
? Evaluating (My-Local-String == "A1000" ) -> FALSE
++? if (Called-Station-Id == "AC-86-74-46-65-91:Peep" && My-Local-String == "A1000" ) -> FALSE
++- entering else else {...}
+++[reject] returns reject
++- else else returns reject
Using Post-Auth-Type Reject


The baffling part is where it says "Attribute My-Local-String was not found." Am I completely barking up the wrong tree here? Is ldap.attrmap meant to be used for something completely different?

Thanks....