<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=utf-8">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7655.1">
<TITLE>Re: Dynamic VLAN attribute in LDAP or AD?</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/plain format -->
<P><FONT SIZE=2>Agreed. I didn't know if I could do some group checking with ntlm_auth, more accurately get a list of groups a user belongs to? If I used FQDN I could prolly parse out the info I need from the user name as well: gary.neteng.waddell.... Ill try LDAP - good learning experience!<BR>
<BR>
----- Original Message -----<BR>
From: freeradius-users-bounces+ggatten=waddell.com@lists.freeradius.org <freeradius-users-bounces+ggatten=waddell.com@lists.freeradius.org><BR>
To: freeradius-users@lists.freeradius.org <freeradius-users@lists.freeradius.org><BR>
Sent: Mon Aug 24 15:48:40 2009<BR>
Subject: RE: Dynamic VLAN attribute in LDAP or AD?<BR>
<BR>
<BR>
> Interesting... I'm assuming I could use existing LDAP attribs and remap<BR>
> them as needed? Ie: "Fax Number" could be mapped to Tunnel ID?<BR>
> Extending the schema is like getting teeth pulled.<BR>
<BR>
Resist the temptation and extend the schema now instead of later. When<BR>
you need the Fax Number, what will you do?<BR>
<BR>
If you don't want to tackle LDAP, you could write a script to generate a<BR>
separate file of unlang if-then blocks and pull it into the FR conf file<BR>
with an $INCLUDE statement.<BR>
<BR>
> Also, no way to do this with NTLM auth is there?<BR>
<BR>
No. NTLM_auth is an authentication tool that returns 0 or 1 depending on<BR>
the correctness of a password. This is an authorization question - what<BR>
kind of access will the authenticated user be given?<BR>
<BR>
<BR>
<BR>
> -----Original Message-----<BR>
> From: Jason Alderfer [<A HREF="mailto:jha2@emu.edu">mailto:jha2@emu.edu</A>]<BR>
> Sent: Monday, August 24, 2009 2:10 PM<BR>
> To: Gary Gatten<BR>
> Subject: RE: Dynamic VLAN attribute in LDAP or AD?<BR>
><BR>
><BR>
>> So, by looking at this more carefully I'll have to do a bunch of<BR>
>> if/else's or cases? What if for instance I have 500<BR>
> departments/groups<BR>
>> - 500 different vlans? I'll have to test each one?<BR>
>><BR>
>> I guess what I was hoping to do was something like:<BR>
>><BR>
>> Get attribute "n" for user y (where n = a value used for<BR>
>> Tunnel-Private-Group-Id"<BR>
><BR>
> You will need to extend your LDAP schema to include the attributes<BR>
> needed<BR>
> for the VLAN and make sure they are properties of the objects that you<BR>
> want them to apply to.<BR>
><BR>
> Then you will need to add these attributes to the FR ldap.attrmap file,<BR>
> e.g.<BR>
><BR>
> replyItem Tunnel-Type radiusTunnelType<BR>
> replyItem Tunnel-Medium-Type radiusTunnelMediumType<BR>
> replyItem Tunnel-Private-Group-Id<BR>
> radiusTunnelPrivateGroupId<BR>
><BR>
> Now the LDAP module should be able to set these attributes automatically<BR>
> for each request if you enable it in the authorize or post-auth section.<BR>
><BR>
> Jason<BR>
<BR>
<BR>
-<BR>
List info/subscribe/unsubscribe? See <A HREF="http://www.freeradius.org/list/users.html">http://www.freeradius.org/list/users.html</A><BR>
</FONT>
</P>
<font size="1">
<div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'>
</div>
"This email is intended to be reviewed by only the intended recipient
and may contain information that is privileged and/or confidential.
If you are not the intended recipient, you are hereby notified that
any review, use, dissemination, disclosure or copying of this email
and its attachments, if any, is strictly prohibited. If you have
received this email in error, please immediately notify the sender by
return email and delete this email from your system."
</font>
</BODY>
</HTML>