<html><head><style type='text/css'>p { margin: 0; }</style></head><body><div style='font-family: Times New Roman; font-size: 12pt; color: #000000'>Problem: Cannot expand %{Realm} or %{Suffix} control attributes for use unless realm is explicitly defined in proxy.conf<br><br>I'm using freeradius2-2.1.7-7.el5 with ldap module. I would like to perform an ldap dip to get the radiusProxyToRealm attribute for each request based on Suffix as configured in modules/ldap:<br><br>filter = "(radiusRealm=%{Suffix})"<br><br>NOTE: If using <filter = "(radiusRealm=domain.com)"> in modules/ldap, radiusProxyToRealm is returned successfully and things work as expected. In this case the Proxy-To-Realm (which is mapped in ldap.attrmap) is set in ldap to proxy.com and proxy.com is defined in proxy.conf.<br><br>Output from radiusd -X:<br>...<br>[suffix] Looking up realm "domain.com" for User-Name = "test@domain.com"<br>[suffix] No such realm "domain.com"<br>++[suffix] returns noop<br>++[files] returns noop<br>[ldap] performing user authorization for test@domain.com<br>[ldap] expand: (radiusRealm=%{Suffix}) -> (radiusRealm=)<br>...<br><br>After reading man unlang, I have also attempted (without success) to expand using the following in ldap filter:<br><br>%{control:Realm}<br>%{control:Suffix}<br>%{suffix:User-Name}<br>%{realm:User-Name}<br><br>Finally, after revisiting man rlm_realm, I read the following which is of concern as I don't see any other way to utilize the radiusProxyToRealm attribute in ldap:<br><br>"In either case, a Realm attribute is created and added to the packet on a match, which can be used by other modules."<br><br>Is there currently anyway to always match (regardless if the realm is defined in proxy.conf) in order to create a Stripped-User-Name and Realm run-time variable with every request?<br><br>Regards,<br><br>Rob<br></div></body></html>