<div>I added 3 groups called tier1,2 and 3 like cn=tier3,ou=People,dc=somedomain,dc=com and added a user to that group. That user is not able to log on. Here is the output. Note the "member=" and "uniquemember=". Ldap-UserDn values are null???</div>
<div> </div>
<div> [ldap] performing search in ou=People,dc=somedomain,dc=com, with filter (&(cn=tier3)(|(&(objectClass=GroupOfNames)(member=))(&(objectClass=GroupOfUniqueNames)(uniquemember=))))<br>request done: ld 0x91aff80 msgid 3<br>
[ldap] object not found<br> [ldap] ldap_release_conn: Release Id: 0<br>rlm_ldap::ldap_groupcmp: Group tier3 not found or user is not a member.<br> [ldap] Entering ldap_groupcmp()<br>[files] expand: ou=People,dc=somedomain,dc=com -> ou=People,dc=somedomain,dc=com<br>
[files] expand: (|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=))(&(objectClass=GroupOfUniqueNames)(uniquemember=)))<br>
[ldap] ldap_get_conn: Checking Id: 0<br> [ldap] ldap_get_conn: Got Id: 0<br> [ldap] performing search in ou=People,dc=somedomain,dc=com, with filter (&(cn=tier2)(|(&(objectClass=GroupOfNames)(member=))(&(objectClass=GroupOfUniqueNames)(uniquemember=))))<br>
request done: ld 0x91aff80 msgid 4<br> [ldap] object not found<br> [ldap] ldap_release_conn: Release Id: 0<br>rlm_ldap::ldap_groupcmp: Group tier2 not found or user is not a member.<br> [ldap] Entering ldap_groupcmp()<br>
[files] expand: ou=People,dc=somedomain,dc=com -> ou=People,dc=somedomain,dc=com<br>[files] expand: (|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=))(&(objectClass=GroupOfUniqueNames)(uniquemember=)))<br>
[ldap] ldap_get_conn: Checking Id: 0<br> [ldap] ldap_get_conn: Got Id: 0<br> [ldap] performing search in ou=People,dc=somedomain,dc=com, with filter (&(cn=tier1)(|(&(objectClass=GroupOfNames)(member=))(&(objectClass=GroupOfUniqueNames)(uniquemember=))))<br>
request done: ld 0x91aff80 msgid 5<br> [ldap] object not found<br> [ldap] ldap_release_conn: Release Id: 0<br>rlm_ldap::ldap_groupcmp: Group tier1 not found or user is not a member.<br><br></div>
<div class="gmail_quote">On Thu, Jul 29, 2010 at 12:00 PM, Natr Brazell <span dir="ltr"><<a href="mailto:natrbrazell@gmail.com">natrbrazell@gmail.com</a>></span> wrote:<br>
<blockquote style="BORDER-LEFT: #ccc 1px solid; MARGIN: 0px 0px 0px 0.8ex; PADDING-LEFT: 1ex" class="gmail_quote">
<div>Ooh! I'll try the LDAP-Group. wrt the Juniper-Local-User-Name VSA:</div>
<div> </div>
<div>Once authenticated against LDAP the user is mapped to the NAS device where there is a username called tier3 (or whatever you called it. Could be superduck). That username is matched against a class which defines a specific set of available commands. The default classes on a juniper router and switch (out of the box) are tier1 (read-only), tier2 (show and some configure commands) and tier3 (or superuser). The audits on both the NAS and in the radius radacct log show the User-Name value as the LDAP uid. When a user types a command such as 'edit' the NAS returns a Juniper-Interactive-Command value = 'edit'. In this way we have a full record of every command each user types on any Juniper device in our accounting logs. Doing this provides very granular control over what users have what permisisons and provides a mechanism for tracking, troubleshooting and accountability.</div>
<div> </div>
<div>Thanks Alan,</div>
<div>N<font color="#888888"><br><br></font></div>
<div>
<div></div>
<div class="h5">
<div class="gmail_quote">On Thu, Jul 29, 2010 at 11:35 AM, Alan DeKok <span dir="ltr"><<a href="mailto:aland@deployingradius.com" target="_blank">aland@deployingradius.com</a>></span> wrote:<br>
<blockquote style="BORDER-LEFT: #ccc 1px solid; MARGIN: 0px 0px 0px 0.8ex; PADDING-LEFT: 1ex" class="gmail_quote">
<div>Natr Brazell wrote:<br>> I am looking for information on grouping users into profiles/groups.<br>> I've searched around the FAQ's and docs but not finding a clear<br>> picture. I've found how to associate a user with a group of NAS's.<br>
<br></div> See "man rlm_passwd" It can be used to create arbitrary groups,<br>including groups of users.<br>
<div><br>> Here's the scenario. There is a specfic VSA from Juniper called<br>> Juniper-Local-User-Name. This gets mapped to a locally defined profile<br>> on the NAS. In the users file I have the following:<br>
><br>> bob.smith Juniper-Local-User-Name = "tier3",<br><br></div> What does that do?<br>
<div><br>> So to the point, rather than defining each user with the same parameters<br>> every time, can I create a group, for instance TIER3, and associate<br>> User-Name's above to the group. And if so how or point me to some<br>
> specific examples.<br>><br>> I am using LDAP also so if there is an LDAP solution same question. Howto?<br><br></div> Put the users into an LDAP group, and use LDAP-Group checking:<br><br>DEFAULT LDAP-Group == "tier2"<br>
<div>
<div></div>
<div> Juniper-Deny-Commands "(show system alarms)|(show system software)"<br><br></div></div><font color="#888888"> Alan DeKok.<br>-<br>List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br>
</font></blockquote></div><br></div></div></blockquote></div><br>