<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Alexander Clouter wrote:
<blockquote cite="mid:og87d8-hkv.ln1@chipmunk.wormnet.eu" type="cite"><br>
<pre wrap=""><!---->I thought I remembered this popping up recently, I would have mentioned
it earlier but my Google-Fu at the time was weak and I though I was
imagining things.
If you checkout v2.1.x[1] and then type:
----
$ git checkout -b foreach
$ git cherry-pick a3221304
$ git cherry-pick 11aa4442
$ git cherry-pick ba18f024
$ git cherry-pick de60e732
$ <mumble, compile, mumble, install, mumble>
----
It will either:
* give you foreach[2] ('man 5 unlang')
* make your pants explode[3]
Cheers
[1] <a class="moz-txt-link-freetext" href="http://git.freeradius.org/">http://git.freeradius.org/</a>
[2] <a class="moz-txt-link-freetext" href="http://freeradius.1045715.n5.nabble.com/regex-matching-can-be-convinced-to-be-TRUE-if-you-re-insistive-enough-td4422200.html">http://freeradius.1045715.n5.nabble.com/regex-matching-can-be-convinced-to-be-TRUE-if-you-re-insistive-enough-td4422200.html</a>
[3] <a class="moz-txt-link-freetext" href="http://www.youtube.com/watch?v=Ysw4Xv6JI_w">http://www.youtube.com/watch?v=Ysw4Xv6JI_w</a> (0:00 -> 0:30 seconds)
</pre>
</blockquote>
Thanks for the heads-up. I know this won't be of much help to anyone
else as a generic solution, but in a rlm_perl-induced fit of rage (I
have about as much experience with and fondness for perl as ... someone
who has nothing of something) I decided to step back and whiteboard the
problem. I ended up managing to get a hold of the department that runs
LDAP, got a list of all of the possible attribute values, and just did
a <br>
update reply {<br>
employeeType -= badValueHere<br>
}<br>
to get rid of the values I don't want, before doing case-insensitive
regex string comparisons on reply:employeeType[*]. With a default of
reject (oversimplified) this works fine.<br>
<br>
But thanks to everyone for the advice... hopefully it will be useful
for the next person with these questions.<br>
<br>
-Jason Antman<br>
<br>
PS - Unfortunately my overcomplicated unlang authenticate{} section is
because I'm required to log to SQL in realtime (i.e. not parsing text
log files) the result of each authentication attempt, and *why* - i.e.
what specific rule was used to deny someone access, or what rule
triggered successful authentication. FreeRadius doesn't seem to have
any support for this, other than lots of updates{} to custom local
attributes.<br>
</body>
</html>