<html><head><style type='text/css'>body { font-family: 'Times New Roman'; font-size: 12pt; color: #000000}</style></head><body>All,<br><br>I have still not been able to find a solution for this, it looks like I might be able to use an xlat rule for it, but I can't get my head around how to write it. Can anyone point me to suitable documentation for xlat - while I have read all the docco that comes with the FreeRadius (in /usr/share) I am missing something in order to apply it.<br><br>Cheers,<br>David<br>----- Original Message -----<br>From: "David Hobley" <david.hobley@mionegroup.com><br>To: freeradius-users@lists.freeradius.org<br>Sent: Tuesday, 23 October 2007 04:10:51 PM (GMT+1000) Australia/Brisbane<br>Subject: Configure authentication via LDAP Group membership issue<br><br><style>body { font-family: 'Times New Roman'; font-size: 12pt; color: #000000}</style><div>I have set up a VPN pointing to a FreeRadius server and have it<br>authenticating successfully against my LDAP server, but I would also like to<br>limit access to only those people who are a member of the VPN group.<br><br>Normally, this would be simple, but because of the LDAP server I am using,<br>the hierarchy looks like this:<br><br>User Account:<br><br>ldapsearch -h ldap -x -b "dc=MY,dc=DOMAIN" "(uid=firstname.lastname)"<br>dn: uid=firstname.lastname,ou=people,dc=MY,dc=DOMAIN<br>uidNumber: 1024<br>...<br><br>Group entry is:<br><br>ldapsearch -h ldap -x -b "dc=MY,dc=DOMAIN" "(cn=VPN Users)"<br>dn: cn=VPN Users,ou=groups,dc=MY,dc=DOMAIN<br>memberUid: 1024<br>...<br><br>So I need to somehow configure Radius to search on me, get my uidNumber and<br>then search on the group. If I skip the searching to get the uidNumber, I<br>can configure the Radius (for this single account) correctly:<br><br>In the ldap module I include:<br> ...<br> groupname_attribute = cn<br> groupmembership_filter = "(memberUid=1024)"<br>with the following entry in the users file:<br><br>DEFAULT Auth-Type = LDAP<br> Fall-Through = 1<br><br>DEFAULT LDAP-Group == "VPN Users"<br> Service-Type = Administrative-User<br><br>and this works as expected, but is there any way I can substitute the 1024<br>for an ldap search result so I can dynamically return the uidNumber for the<br>%{User-Name} field?<br><br>Thanks!<br><br>Cheers,<br>David<br><br></div><br></body></html>