<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<META content="MSHTML 6.00.2900.3395" name=GENERATOR></HEAD>
<BODY>
<DIV><SPAN class=389275617-09102008><FONT face=Arial size=2>Hello
</FONT></SPAN></DIV>
<DIV><SPAN class=389275617-09102008><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=389275617-09102008><FONT face=Arial size=2>I have ldap working
to authencate users to a cisci switch. I now want to limit it to group
membership. Any help would be great. </FONT></SPAN></DIV>
<DIV><SPAN class=389275617-09102008><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=389275617-09102008><FONT face=Arial size=2>Here is what I have
in my ldap config for the groups. </FONT></SPAN></DIV>
<DIV><SPAN class=389275617-09102008><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=389275617-09102008><FONT face=Arial size=2># Group
membership checking. Disabled by
default.<BR>
#<BR> groupname_attribute =
"cn"<BR> groupmembership_filter
=
"(|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))"<BR>
groupmembership_attribute = "radius"</FONT></SPAN></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><SPAN class=389275617-09102008><FONT face=Arial
size=2> #compare_check_items =
yes<BR> # do_xlat =
yes<BR> #access_attr_used_for_allow
= yes</FONT></SPAN></DIV>
<DIV><SPAN class=389275617-09102008><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=389275617-09102008><FONT face=Arial size=2>Here is waht I see
in my logs with radiusd -X</FONT></SPAN></DIV>
<DIV><SPAN class=389275617-09102008><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=389275617-09102008><FONT face=Arial size=2>Ready to process
requests.<BR>rad_recv: Access-Request packet from host 10.12.8.230 port 1645,
id=35, length=86<BR> User-Name =
"bbeaudin"<BR> User-Password =
"xxxxxxx^"<BR> NAS-Port =
194<BR> NAS-Port-Id =
"tty194"<BR> NAS-Port-Type =
Virtual<BR> Calling-Station-Id =
"10.12.8.71"<BR> NAS-IP-Address =
10.12.8.230<BR>+- entering group authorize<BR>++[preprocess] returns
ok<BR>++[chap] returns noop<BR>++[mschap] returns noop<BR>
rlm_realm: No <A href="mailto:'@'">'@'</A> in User-Name = "bbeaudin", looking up
realm NULL<BR> rlm_realm: No such realm "NULL"<BR>++[suffix]
returns noop<BR> rlm_eap: No EAP-Message, not doing EAP<BR>++[eap] returns
noop<BR>++[unix] returns updated<BR>rlm_ldap: Entering
ldap_groupcmp()<BR> expand:
OU=Employees,DC=yipes,DC=com ->
OU=Employees,DC=yipes,DC=com<BR>
expand: (&(samaccountname=%{user-name})) ->
(&(samaccountname=bbeaudin))<BR>rlm_ldap: ldap_get_conn: Checking Id:
0<BR>rlm_ldap: ldap_get_conn: Got Id: 0<BR>rlm_ldap: attempting LDAP
reconnection<BR>rlm_ldap: (re)connect to dendc1.yipes.com:389, authentication
0<BR>rlm_ldap: bind as <A
href="mailto:bbeaudin@yipes.com/xxxxxxxx">bbeaudin@yipes.com/xxxxxxxx</A> to
dendc1.yipes.com:389<BR>rlm_ldap: waiting for bind result ...<BR>request done:
ld 0x121a6760 msgid 1<BR>rlm_ldap: Bind was successful<BR>rlm_ldap: performing
search in OU=Employees,DC=yipes,DC=com, with filter
(&(samaccountname=bbeaudin))<BR>request done: ld 0x121a6760 msgid
2<BR>rlm_ldap: ldap_release_conn: Release Id:
0<BR> expand:
(|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))
-> (|(&(objectClass=GroupOfNames)(member=CN\3dBert Beaudin\2cOU\3dIT
Staff\2cOU\3dEmployees\2cDC\3dyipes\2cDC\3dcom))(&(objectClass=GroupOfUniqueNames)(uniquemember=)))<BR>rlm_ldap:
ldap_get_conn: Checking Id: 0<BR>rlm_ldap: ldap_get_conn: Got Id: 0<BR>rlm_ldap:
performing search in cn=radius,dc=yipes,dc=com, with filter
(|(&(objectClass=GroupOfNames)(member=CN\3dBert Beaudin\2cOU\3dIT
Staff\2cOU\3dEmployees\2cDC\3dyipes\2cDC\3dcom))(&(objectClass=GroupOfUniqueNames)(uniquemember=)))<BR>request
done: ld 0x121a6760 msgid 3<BR>rlm_ldap: object not found or got ambiguous
search result<BR>rlm_ldap: ldap_release_conn: Release Id: 0<BR>rlm_ldap:
ldap_get_conn: Checking Id: 0<BR>rlm_ldap: ldap_get_conn: Got Id: 0<BR>rlm_ldap:
performing search in CN=Bert Beaudin,OU=IT Staff,OU=Employees,DC=yipes,DC=com,
with filter (objectclass=*)<BR>request done: ld 0x121a6760 msgid
4<BR>rlm_ldap::ldap_groupcmp: ldap_get_values() failed<BR>rlm_ldap:
ldap_release_conn: Release Id: 0<BR>++[files] returns noop<BR>rlm_ldap: -
authorize<BR>rlm_ldap: performing user authorization for
bbeaudin<BR> expand:
(&(samaccountname=%{user-name})) ->
(&(samaccountname=bbeaudin))<BR>
expand: OU=Employees,DC=yipes,DC=com ->
OU=Employees,DC=yipes,DC=com<BR>rlm_ldap: ldap_get_conn: Checking Id:
0<BR>rlm_ldap: ldap_get_conn: Got Id: 0<BR>rlm_ldap: performing search in
OU=Employees,DC=yipes,DC=com, with filter
(&(samaccountname=bbeaudin))<BR>request done: ld 0x121a6760 msgid
5<BR>rlm_ldap: looking for check items in directory...<BR>rlm_ldap: looking for
reply items in directory...<BR>rlm_ldap: Pairs do not match. Rejecting
user.<BR>rlm_ldap: ldap_release_conn: Release Id: 0<BR>++[ldap] returns
reject<BR> Found Post-Auth-Type Reject<BR>+- entering group
REJECT<BR> expand: %{User-Name} ->
bbeaudin<BR> attr_filter: Matched entry DEFAULT at line
11<BR>++[attr_filter.access_reject] returns updated<BR>Sending Access-Reject of
id 35 to 10.12.8.230 port 1645<BR>Finished request 0.<BR>Going to the next
request<BR>Waking up in 4.9 seconds.<BR>Cleaning up request 0 ID 35 with
timestamp +9<BR>Ready to process requests.</FONT></SPAN></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><SPAN class=389275617-09102008><FONT face=Arial
size=2>Thanks,</FONT></SPAN></DIV>
<P class=MsoNormal align=left><SPAN
style="FONT-FAMILY: Arial; mso-bidi-font-family: 'Times New Roman'">Bert
Beaudin<BR>Systems Administrator<BR>RelianceGlobalcom Services, Inc<SPAN
class=GramE>.</SPAN><BR>Office:303-785-6641<BR>Cell:303-478-7789<BR>Fax:<SPAN
style="mso-tab-count: 1">4</SPAN>15-677-9534<BR><A
href="mailto:bbeaudin@relianceglobalcom.com"><SPAN style="FONT-SIZE: 10pt"><FONT
size=3>bbeaudin@relianceglobalcom.com</FONT></SPAN></A><BR></SPAN><SPAN
style="FONT-SIZE: 10pt; COLOR: black; FONT-FAMILY: Arial"><A
title=http://www.yipes.com/ href="blocked::http://www.yipes.com/"><SPAN
style="COLOR: windowtext; TEXT-DECORATION: none; text-underline: none"><SPAN
title=http://www.yipes.com/><SPAN title=http://www.yipes.com/><FONT
size=3>www.relianceglobalcom.com</FONT></SPAN></SPAN></SPAN></A></SPAN><SPAN
style="FONT-FAMILY: Arial; mso-bidi-font-family: 'Times New Roman'"><BR></SPAN><IMG
height=72 src="cid:389275617@09102008-3242" width=146 border=0
v:shapes="_x0000_i1025"></P><SPAN
style="FONT-SIZE: 10pt; COLOR: black; FONT-FAMILY: Arial"><?xml:namespace prefix
= o ns = "urn:schemas-microsoft-com:office:office" /><o:p></o:p></SPAN>
<DIV> </DIV></BODY></HTML>