<html><head><style type="text/css"><!-- DIV {margin:0px;} --></style></head><body><div style="font-family:times new roman,new york,times,serif;font-size:12pt"><div><br></div><div style="font-family: times new roman,new york,times,serif; font-size: 12pt;"><br><div style="font-family: arial,helvetica,sans-serif; font-size: 13px;"><font face="Tahoma" size="2"><hr size="1"><b><span style="font-weight: bold;">From:</span></b> Alan DeKok <aland@deployingradius.com><br><b><span style="font-weight: bold;">To:</span></b> FreeRadius users mailing list <freeradius-users@lists.freeradius.org><br><b><span style="font-weight: bold;">Sent:</span></b> Thu, January 28, 2010 1:00:47 AM<br><b><span style="font-weight: bold;">Subject:</span></b> Re: Allowing Access via 'users' when LDAP fails<br></font><br>
Amaru Netapshaak wrote:<br>> Right now, if a user<br>> isnt found in the LDAP database, a reject is returned to the switch and<br>> the port goes<br>> offline. What I'd rather have,is RADIUS reply with a standard response<br>> (if the LDAP<br>> auth fails).<br><br> See doc/configurable_failover for over-riding return codes.<br><br>> I tried to do this in the users file, by moving 'files' to below 'ldap'<br>> in sites-enabled/default<br>> and then creating a DEFAULT entry in users that returned the VLAN<br>> information I wanted,<br>> but then it didnt include other relevant info that the switch needs.<br><br> That won't work.<br><br> What you want is:<br><br> ldap<br> if (notfound) {<br> update reply {<br> ... insert attributes here...<br>
}<br> }<br><br> You don't need the "users" file.<br><br> Alan DeKok.<br><br>Alan,<br><br>Thanks for your reply, I consulted the failover document as you suggested, but it seems that I cannot turn a REJECT into an ACCEPT<br>that way, which is my problem. LDAP/EAP will reject an unauthorized user as it isnt found in LDAP, but I need FreeRADIUS to say "ACCEPT"<br>this user anyways, include the right EAP information, as would a Access-Accept message, and also include my VLAN attributes (done as you<br>described above)<br><br>Just cant seem to turn REJECT into ACCEPT. Any more tips?<br><br>Thanks!<br>AMARU<br><br><br></div></div>
<!-- cg31.c2.mail.re1.yahoo.com compressed/chunked Fri Jan 29 11:22:01 PST 2010 -->
</div><br>
</body></html>