<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-2" http-equiv="Content-Type">
<title></title>
</head>
<body bgcolor="#ffffff" text="#000000">
Hi.<br>
I am currently using FreeRadius server 1.0.2 on Solaris 8 with LDAP
authentication and MySQL accounting<br>
for PPPoE sessions with ADSL technology.<br>
Everything works fine, but some problems appeared lately.<br>
User profiles are stored in some subtree of LDAP server. Each user has
an attribute radiusGroupName set to test<br>
(for example). I would like to setup some common attribute values in
the group profile, which is also stored in<br>
the LDAP server but in the other subtree, and import them to user
profile during authentication.<br>
Now it does not work. Unfortunately I do not have much space to
experiment because it is working<br>
configration and I really do not have an idea how to setup this kind of
behaviour.<br>
Parts of my config files are below:<br>
<u>huntgroups:<br>
</u><font face="Courier New, Courier, monospace">cisco
NAS-IP-Address == 192.168.0.211<br>
</font><br>
<u>clients.conf:<br>
</u><font face="Courier New, Courier, monospace">client 192.168.0.211 {<br>
secret = cisco<br>
nastype = cisco<br>
shortname = c7200vxr<br>
}<br>
</font><br>
<br>
<u>radiusd.conf:</u><br>
<font face="Courier New, Courier, monospace"><br>
# MODULE CONFIGURATION<br>
modules {<br>
pap {<br>
encryption_scheme = crypt<br>
}<br>
<br>
chap {<br>
authtype = CHAP<br>
}<br>
<br>
pam {<br>
pam_auth = radiusd<br>
}<br>
<br>
unix {<br>
cache = no<br>
cache_reload = 600<br>
radwtmp = ${logdir}/radwtmp<br>
}<br>
<br>
$INCLUDE ${confdir}/eap.conf<br>
<br>
mschap {<br>
authtype = MS-CHAP<br>
}<br>
<br>
ldap {<br>
server = "ds1i.ostisp.intra ds2i.ostisp.intra"<br>
identity = "cn=freeradius,ou=admins,o=radius,dc=ostnet,dc=pl"<br>
password = radius<br>
basedn = "ou=users,ou=adsl,o=radius,dc=ostnet,dc=pl"<br>
filter = "(cn=%{Stripped-User-Name:-%{User-Name}})"<br>
base_filter = "(objectclass=radiusprofile)"<br>
password_attribute = userPassword<br>
<br>
# access_attr = "dialupAccess"<br>
dictionary_mapping = ${raddbdir}/ldap_ext.attrmap<br>
<br>
groupname_attribute = radiusGroupName<br>
groupmembership_filter =
"(cn=%{Stripped-User-Name:-%{User-Name}})(objectclass=radiusprofile)"<br>
groupmembership_attribute = radiusGroupName<br>
<br>
ldap_connections_number = 40<br>
timeout = 4<br>
timelimit = 3<br>
net_timeout = 1<br>
}<br>
<br>
realm IPASS {<br>
format = prefix<br>
delimiter = "/"<br>
ignore_default = no<br>
ignore_null = no<br>
}<br>
<br>
realm suffix {<br>
format = suffix<br>
delimiter = "@"<br>
ignore_default = no<br>
ignore_null = no<br>
}<br>
<br>
realm realmpercent {<br>
format = suffix<br>
delimiter = "%"<br>
ignore_default = no<br>
ignore_null = no<br>
}<br>
<br>
realm ntdomain {<br>
format = prefix<br>
delimiter = "\\"<br>
ignore_default = no<br>
ignore_null = no<br>
}<br>
<br>
<br>
checkval {<br>
item-name = Calling-Station-Id<br>
check-name = Calling-Station-Id<br>
data-type = string<br>
}<br>
<br>
preprocess {<br>
huntgroups = ${confdir}/huntgroups<br>
hints = ${confdir}/hints<br>
with_ascend_hack = no<br>
ascend_channels_per_line = 23<br>
with_ntdomain_hack = no<br>
with_specialix_jetstream_hack = no<br>
with_cisco_vsa_hack = no<br>
}<br>
<br>
files {<br>
usersfile = ${confdir}/users<br>
acctusersfile = ${confdir}/acct_users<br>
compat = no<br>
}<br>
<br>
detail {<br>
detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d<br>
detailperm = 0600<br>
}<br>
<br>
detail auth_log {<br>
detailfile =
${radacctdir}/%{Client-IP-Address}/auth-detail-%Y%m%d<br>
}<br>
<br>
detail reply_log {<br>
detailfile =
${radacctdir}/%{Client-IP-Address}/reply-detail-%Y%m%d<br>
detailperm = 0600<br>
}<br>
<br>
acct_unique {<br>
key = "User-Name, Acct-Session-Id, NAS-IP-Address,
Client-IP-Address, NAS-Port"<br>
}<br>
<br>
radutmp {<br>
filename = ${logdir}/radutmp<br>
# username = %{User-Name}<br>
username = %{Stripped-User-Name:-%{User-Name}}<br>
case_sensitive = no<br>
check_with_nas = yes <br>
perm = 0600<br>
callerid = "no"<br>
}<br>
<br>
<br>
attr_filter {<br>
attrsfile = ${confdir}/attrs<br>
}<br>
<br>
counter daily {<br>
filename = ${raddbdir}/db.daily<br>
key = User-Name<br>
count-attribute = Acct-Session-Time<br>
reset = daily<br>
counter-name = Daily-Session-Time<br>
check-name = Max-Daily-Session<br>
allowed-servicetype = Framed-User<br>
cache-size = 5000<br>
}<br>
<br>
always fail {<br>
rcode = fail<br>
}<br>
always reject {<br>
rcode = reject<br>
}<br>
always ok {<br>
rcode = ok<br>
simulcount = 0<br>
mpp = no<br>
}<br>
<br>
expr {<br>
}<br>
<br>
digest {<br>
}<br>
<br>
exec {<br>
wait = yes<br>
input_pairs = request<br>
}<br>
<br>
exec echo {<br>
wait = yes<br>
program = "/bin/echo %{User-Name}"<br>
input_pairs = request<br>
output_pairs = reply<br>
}<br>
<br>
<br>
$INCLUDE ${confdir}/sql.conf<br>
}<br>
<br>
# Instantiation<br>
instantiate {<br>
expr<br>
detail<br>
}<br>
<br>
authorize {<br>
preprocess<br>
chap<br>
ldap<br>
files<br>
}<br>
<br>
<br>
# Authentication.<br>
authenticate {<br>
Auth-Type CHAP {<br>
chap<br>
}<br>
Auth-Type LDAP {<br>
ldap<br>
}<br>
Auth-Type PAP {<br>
pap<br>
}<br>
unix<br>
}<br>
<br>
<br>
#<br>
# Pre-accounting. Decide which accounting type to use.<br>
#<br>
preacct {<br>
preprocess<br>
acct_unique<br>
suffix<br>
files<br>
}<br>
<br>
#<br>
# Accounting. Log the accounting data.<br>
#<br>
accounting {<br>
sql<br>
}<br>
<br>
<br>
session {<br>
radutmp<br>
}<br>
<br>
<br>
post-auth {<br>
}<br>
<br>
pre-proxy {<br>
}<br>
<br>
post-proxy {<br>
eap<br>
} </font><br>
<br>
<u>users:<br>
</u><font face="Courier New, Courier, monospace">DEFAULT Ldap-Group ==
disabled, Auth-Type := Reject<br>
Reply-Message = "Blocked account."<br>
<br>
DEFAULT Huntgroup-Name == cisco, LDAP-Group == ostinternet,
User-Profile :=
"cn=ostinternet,ou=profiles,ou=adsl,o=radius,dc=ostnet,dc=pl"<br>
Fall-Through = no<br>
<br>
DEFAULT Huntgroup-Name == huawei, LDAP-Group == ostinternet,
User-Profile :=
"cn=ostinternet,ou=profiles,ou-adsl,o=radius,dc=ostnet,dc=pl"<br>
Fall-Through = no<br>
</font><br>
<br>
Write if You have any ideas.<br>
Thanks in advance.<br>
</body>
</html>