Thanks for explaining that Phil, appreciate it. <br><br>I had come to the conclusion that I couldn't enclose these references because it was trying to expand them and thus expecting them to have a single value. Similarly I couldn't assign from them because of this same reason. But still I was missing the point that you made, that these references implement their own == routine to accomplish these comparisons. I hadn't dealt with Operator Overloading before either so that helped put that in perspective when I looked that up. <br>
<br>I'm still completely stumped though why I can't get any joy from my comparisons using the following IF statement <br><br> if (Group-Name == 'net_su') {<br> update control {<br> Tmp-String-2 := 'net_su'<br>
}<br> }<br><br><br>The Group-Name checks I have in my Users file return as expected, but I couldn't see any reason why they aren't working here from the output of my debug log below <br><br>
<div style="margin-left: 40px;">[ldap] performing user authorization for cameron<br>[ldap] expand: %{Stripped-User-Name} -> <br>[ldap] expand: %{User-Name} -> cameron<br>[ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=cameron)<br>
[ldap] expand: dc=ac3,dc=com,dc=au -> dc=ac3,dc=com,dc=au<br>rlm_ldap: ldap_get_conn: Checking Id: 0<br>rlm_ldap: ldap_get_conn: Got Id: 0<br>rlm_ldap: attempting LDAP reconnection<br>rlm_ldap: (re)connect to <a href="http://kenrose.ac3.com.au:389">kenrose.ac3.com.au:389</a>, authentication 0<br>
rlm_ldap: bind as / to <a href="http://kenrose.ac3.com.au:389">kenrose.ac3.com.au:389</a><br>rlm_ldap: waiting for bind result ...<br>rlm_ldap: Bind was successful<br>rlm_ldap: performing search in dc=ac3,dc=com,dc=au, with filter (uid=cameron)<br>
[ldap] looking for check items in directory...<br>[ldap] looking for reply items in directory...<br>WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly?<br>[ldap] Setting Auth-Type = LDAP<br>
[ldap] user cameron authorized to use remote access<br>rlm_ldap: ldap_release_conn: Release Id: 0<br>++[ldap] returns ok<br>++[expiration] returns noop<br>++[logintime] returns noop<br>[pap] Found existing Auth-Type, not changing it.<br>
++[pap] returns noop<br>++? if (Ldap-Group == 'net_su')<br>rlm_ldap: Entering ldap_groupcmp()<br> expand: dc=ac3,dc=com,dc=au -> dc=ac3,dc=com,dc=au<br> expand: (|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=))(&(objectClass=GroupOfUniqueNames)(uniquemember=)))<br>
rlm_ldap: ldap_get_conn: Checking Id: 0<br>rlm_ldap: ldap_get_conn: Got Id: 0<br>rlm_ldap: performing search in dc=ac3,dc=com,dc=au, with filter (&(cn=net_su)(|(&(objectClass=GroupOfNames)(member=))(&(objectClass=GroupOfUniqueNames)(uniquemember=))))<br>
rlm_ldap: object not found<br>rlm_ldap: ldap_release_conn: Release Id: 0<br>rlm_ldap::ldap_groupcmp: Group net_su not found or user is not a member.<br>? Evaluating (Ldap-Group == 'net_su') -> FALSE<br>++? if (Ldap-Group == 'net_su') -> FALSE<br>
++? if (Group-Name == 'net_su')<br>? Evaluating (Group-Name == 'net_su') -> FALSE<br>++? if (Group-Name == 'net_su') -> FALSE<br>Found Auth-Type = LDAP<br>+- entering group LDAP {...}<br>[ldap] login attempt by "cameron" with password "password123<br>
[ldap] user DN: uid=cameron,ou=People,dc=ac3,dc=com,dc=au<br>rlm_ldap: (re)connect to <a href="http://kenrose.ac3.com.au:389">kenrose.ac3.com.au:389</a>, authentication 1<br>rlm_ldap: bind as uid=cameron,ou=People,dc=ac3,dc=com,dc=au/password123 to <a href="http://kenrose.ac3.com.au:389">kenrose.ac3.com.au:389</a><br>
rlm_ldap: waiting for bind result ...<br>rlm_ldap: Bind was successful<br>[ldap] user cameron authenticated succesfully<br>++[ldap] returns ok<br></div><br><br>The only thing I could think of is that the LDAP settings aren't correct and hence not finding my group memberships, but if this is the case how does Group-Name when used in the Users file find my assigned groups and successfully compares them? <br>
<br><br>Regards<br>Cam. <br>--<br><br><br><br>
<br><br><div class="gmail_quote">On Sun, Sep 26, 2010 at 19:01, Phil Mayers <span dir="ltr"><<a href="mailto:p.mayers@imperial.ac.uk">p.mayers@imperial.ac.uk</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<div class="im">On 09/26/2010 03:08 AM, Cameron Wood wrote:<br>
<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
Thank you Alan B & Alan D for your comments, and I'll make sure to<br>
include the full, complete debug output log in future.<br>
<br>
I don't think the logic of my example has changed since my earlier post,<br>
but I admittedly have tried encasing it in %{...} and adding a list to<br>
it as well to try and get it to compare against the right data.<br>
</blockquote>
<br></div>
That *is* a logic change.<br>
<br>
To be clear: The Group-Name attribute, along with similar attributes (SQL-Group, LDAP-Group) does not have a "value". You cannot have it on the right hand side of an operator.<br>
<br>
The only valid location for these attributes is on the left hand side of an == operator, because internally they "hook" tne == operator, and do this:<br>
<br>
for group in all_groups:<br>
if group == right-hand-side<br>
return True<br>
return False<br>
<br>
So, this is valid in an "unlang" block:<br>
<br>
if (Group-Name == ANYVALUE)<br>
<br>
...but ANYTHING alse you might try is not. In particular, none of the following will work:<br>
<br>
if ("%{Group-Name]" ...)<br>
<br>
update control {<br>
An-Attribute = "%{Group-Name}"<br>
}<br>
if (An-Attribute)<br>
<br>
...and so on.<div class="im"><br>
<br>
<br>
<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
Is the comparison in the right location, in the Authorize section, and<br>
if so am I trying to compare against the wrong attribute, hence it<br>
getting expanded and not returning anything?<br>
<br>
Alan D could you shed some light on how the Group-Name attribute in<br>
Users is populated/gets compared when doing checks there?<br>
</blockquote>
<br></div>
It does not get "populated". The attribute implements its own == handler, which operates as above.<div class="im"><br>
<br>
<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<br>
I suspect from your comment that the field I am trying to check against<br>
since you say it can contain many values "because the user may be a<br>
member of many, many, groups" could be a long string with separators or<br>
an array of values, would this be right? In which case do I need to use<br>
a regex method or access a specific value within an array?<br>
</blockquote>
<br></div>
No. See above. It does NOT have a "value".<br>
<br>
Do you know any programming languages? If so, think "operator overloading".<div><div></div><div class="h5"><br>
-<br>
List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br>
</div></div></blockquote></div><br>