<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Alexander Clouter wrote:
<blockquote cite="mid:o3soc8-fs8.ln1@chipmunk.wormnet.eu" type="cite">
<pre wrap="">Peter Lambrechtsen <a class="moz-txt-link-rfc2396E" href="mailto:plambrechtsen@gmail.com"><plambrechtsen@gmail.com></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">I find the easist way to do it is to use a custom "users" file to allow /
prevent access based on exact matches of LDAP attributes.
then you can say if STAFF = Accept, if STAFF OFFSITE Accept, otherwise
reject.
This is how we do it here:
<a class="moz-txt-link-freetext" href="http://lists.freeradius.org/pipermail/freeradius-users/2010-September/msg00393.html">http://lists.freeradius.org/pipermail/freeradius-users/2010-September/msg00393.html</a>
</pre>
</blockquote>
<pre wrap=""><!----></pre>
</blockquote>
Peter... but how does that work with multivalued attributes? If someone
has employeeType[0] = "FooBar" and employeeType[1] = "STAFF OFFSITE" it
doesn't seem like it would work...<br>
<br>
Also, at the moment, I don't have a users file... I'm using LDAP only,
with the little configuration I need in unlang.<br>
<blockquote cite="mid:o3soc8-fs8.ln1@chipmunk.wormnet.eu" type="cite">
<pre wrap="">Depending on how you have things set up locally and how you are trying
to skin this particular cat, but you could just use an LDAP filter to
get all this done and keep the logic out of FreeRADIUS (although I
probably would *not* recommend it):
----
filter = "(&(objectClass=Person)(employeeType=staff*)(!(employeeType=staff retired))(|(!(loginDisabled=*))(loginDisabled=FALSE))(cn=%{Stripped-User-Name}))"
----
Means you get the effect as if the user did not even exist.
Just throwing another option out there...although I would recommend the
users file with a bunch of fall throughs personally.
Cheers
</pre>
</blockquote>
I know I didn't specify it in my original message, but that loses the
verbose (SQL-ized) logging that I need...<br>
<br>
I don't really know anything about it, and haven't seen mention of it
outside of the modules list, but perhaps I could use rlm_perl or
rlm_python? Does anyone know about the efficiency of these? I know I'm
approaching this from the standpoint of a traditional programming
language, but the way I see it, I just need to loop over the values of
the employeeType[] attribute, and have some sort of variable to store
state...<br>
<br>
-Jason<br>
</body>
</html>