<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=iso-8859-1"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EstiloCorreioElectrnico17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 3.0cm 70.85pt 3.0cm;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=PT link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span lang=EN-US>Hello,<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>I’m trying to minimize ldap queries to Active directory do to heavy load on DC. <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>--------------------------------------------<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>1º - Change query on LDAP module to not search group of group<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>Accomplish using on ldap:<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> filter = "(samaccountname=%{Stripped-User-Name})"<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> dictionary_mapping = ${raddbdir}/ldap.attrmap<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> groupname_attribute = cn<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> groupmembership_filter = "(objectClass=Group)(member=%{check:Ldap-UserDn})"<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>--------------------------------------------<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>2º - Do only one LDAP query for every type<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>I have several campus and several vlan assignment on each campus.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>So I have for example this check items on users file:<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>DEFAULT Huntgroup-Name == "gambelas",ldapnaodocentes-Ldap-Group =="Nao Docentes"<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> Tunnel-Private-Group-ID := 302,<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> …<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>DEFAULT Huntgroup-Name == "gambelas",ldapnaodocentes-Ldap-Group == "e-U-InternoComoExterno"<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> Tunnel-Private-Group-ID := 304,<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> …<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>DEFAULT Huntgroup-Name == "Penha",ldapnaodocentes-Ldap-Group =="Nao Docentes"<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> Tunnel-Private-Group-ID := 602,<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> …<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>And so on….<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>If the user is on last campus, it will query the AD several times for the same group query because even if Huntgroup-Name don’t match, it will run the ldap query of the same check line.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>So I tried this with no success:<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>DEFAULT ldapnaodocentes-Ldap-Group =="Nao Docentes"<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> Tunnel-Type := "VLAN", Tunnel-Medium-Type := "IEEE-802",<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> My-Group:=2,<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> Fall-Through = Yes<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>DEFAULT Huntgroup-Name == "gambelas", My-Group==2<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> Tunnel-Private-Group-ID := 302,<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> Reply-Message = " eduroam Gambelas Nao Docente Vlan 302!",<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>DEFAULT Huntgroup-Name == "penha", My-Group==2<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> Tunnel-Private-Group-ID := 602,<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> Reply-Message = " eduroam Penha Nao Docente Vlan 602!",<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>But the My-Group==2 is not evaluated.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>It is not possible to assign a value to an item and use it later on the users file?<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>--------------------------------------------<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>3º - Several group have the same vlan so i can create a group of groups on AD and do the search by that group.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>The problem is that it search if every group the user belong. If the user have 20 group on AD and have to check for 10 group is users file, it will do 200 search.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>The field tokenGroups on user AD have all the group and group of group for the user, but have a list of SID and not the DN of the group.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>It is possible get the SID of the group instead of the DN to use to search on tokenGroups field of the user AD?<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>--------------------------------------------<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>Tanks<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Pisco<o:p></o:p></span></p></div></body></html>