<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=iso-8859-1"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.E-MailFormatvorlage17
{mso-style-type:personal-compose;
font-family:"Arial","sans-serif";
color:windowtext;
font-weight:normal;
font-style:normal;
text-decoration:none none;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=DE link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span lang=EN-US style='font-size:10.0pt;font-family:"Arial","sans-serif";color:black;mso-fareast-language:DE'>Hello,<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:10.0pt;font-family:"Arial","sans-serif";color:black;mso-fareast-language:DE'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:10.0pt;font-family:"Arial","sans-serif";color:black;mso-fareast-language:DE'>my aim is that only one group of the active directory gets access the others are rejected. I have read in this thread: <a href="http://freeradius.1045715.n5.nabble.com/Conditional-attributes-with-AD-td5541373.html">http://freeradius.1045715.n5.nabble.com/Conditional-attributes-with-AD-td5541373.html</a><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:10.0pt;font-family:"Arial","sans-serif";color:black;mso-fareast-language:DE'>that you can use the ldap module to check group membership and check the output of the checking. I use this filter in the groupmembership checking:<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:10.0pt;font-family:"Arial","sans-serif";color:black;mso-fareast-language:DE'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:10.0pt;font-family:"Arial","sans-serif";color:black;mso-fareast-language:DE'>groupname_attribute = cn<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:10.0pt;font-family:"Arial","sans-serif";color:black;mso-fareast-language:DE'>groupmembership_filter = “(</span><span lang=EN-US>objectClass=group)(member=%{<where the group in the ad is>}))" <br>groupmembership_attribute = memberOf<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>I get this output of the debug of freeRADIUS:<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US> [ldap] ldap_get_conn: Checking Id: 0<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> [ldap] ldap_get_conn: Got Id: 0<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> [ldap] performing search in dc=domain,dc=de, with filter (sAMAccountName=heinrich)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> [ldap] rebind to URL ldap://domain.de/CN=Configuration,DC=domain,DC=de<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> [ldap] ldap_release_conn: Release Id: 0<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> expand: (&(objectClass=group)(member=%{control:cn=group,cn=users,dc=domain,dc=de})) -> (&(objectClass=group)(member=))<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> [ldap] ldap_get_conn: Checking Id: 0<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> [ldap] ldap_get_conn: Got Id: 0<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> [ldap] performing search in cn=group,cn=users,dc=aos-stade,dc=de, with filter (&(objectClass=group)(member=))<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> [ldap] object not found<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> [ldap] ldap_release_conn: Release Id: 0<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> [ldap] ldap_get_conn: Checking Id: 0<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> [ldap] ldap_get_conn: Got Id: 0<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> [ldap] performing search in CN=Heinrich\, Sebastian,CN=Users,DC=aos-stade,DC=de, with filter (objectclass=*)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> [ldap] performing search in CN=group1,CN=Users,DC=aos-stade,DC=de, with filter (cn=cn=group,cn=users,dc=domain,dc=de)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> [ldap] object not found<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> [ldap] performing search in CN=group2,CN=group4,CN=Users,DC=domain,DC=de, with filter (cn=cn=group,cn=users,dc=domain,dc=de)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> [ldap] object not found<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> [ldap] performing search in CN=group3,CN=Users,DC=domain,DC=de, with filter (cn=cn=group,cn=users,dc=domain,dc=de)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> [ldap] object not found<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> [ldap] performing search in CN=group,CN=Users,DC=domain,DC=de, with filter (cn=cn=group,cn=users,dc=domain,dc=de)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> [ldap] object not found<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> [ldap] performing search in CN=group,CN=group4,CN=Users,DC=aos-stade,DC=de, with filter (cn=cn=group,cn=users,dc=domain,dc=de)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> [ldap] object not found<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>rlm_ldap::groupcmp: Group cn=group,cn=users,dc=aos-stade,dc=de not found or user not a member<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> [ldap] ldap_release_conn: Release Id: 0<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:10.0pt;font-family:"Arial","sans-serif";color:black;mso-fareast-language:DE'>I have written this in my inner-tunnel:<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:10.0pt;font-family:"Arial","sans-serif";color:black;mso-fareast-language:DE'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:10.0pt;font-family:"Arial","sans-serif";color:black;mso-fareast-language:DE'>If(!(Ldap-group == ‘cn=group,cn=users,dc=domain,dc=de)) {<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:10.0pt;font-family:"Arial","sans-serif";color:black;mso-fareast-language:DE'>update config {<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:10.0pt;font-family:"Arial","sans-serif";color:black;mso-fareast-language:DE'>Auth-Type := Reject<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:10.0pt;font-family:"Arial","sans-serif";color:black;mso-fareast-language:DE'>}<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:10.0pt;font-family:"Arial","sans-serif";color:black;mso-fareast-language:DE'>}<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:10.0pt;font-family:"Arial","sans-serif";color:black;mso-fareast-language:DE'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:10.0pt;font-family:"Arial","sans-serif";color:black;mso-fareast-language:DE'>Can anybody help me? As I understand the debug the group is checked but the user isn’t member of it. I totally sure that I am a member of the group.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:10.0pt;font-family:"Arial","sans-serif";color:black;mso-fareast-language:DE'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:10.0pt;font-family:"Arial","sans-serif";color:black;mso-fareast-language:DE'>Best Regards</span><span lang=EN-US style='font-size:10.0pt;font-family:"Arial","sans-serif";mso-fareast-language:DE'><br><b><span style='color:black'><br>Sebastian Heinrich</span></b></span><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";mso-fareast-language:DE'><br></span><span lang=EN-US style='font-size:10.0pt;font-family:"Arial","sans-serif";color:black;mso-fareast-language:DE'>Techn. DV <br><br><br><o:p></o:p></span></p><p class=MsoNormal><b><span lang=EN-US style='font-size:10.0pt;font-family:"Arial","sans-serif";color:#00CCFF;mso-fareast-language:DE'>Aluminium Oxid Stade GmbH</span></b><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:black;mso-fareast-language:DE'><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:10.0pt;font-family:"Arial","sans-serif";color:#00CCFF;mso-fareast-language:DE'>Johann-Rathje-Köser-Straße<br>21683 Stade<br><br></span><span style='font-size:10.0pt;font-family:"Arial","sans-serif";color:black;mso-fareast-language:DE'>email S.Heinrich@aos-stade.de<br>web </span><span lang=EN-GB style='font-size:10.0pt;font-family:"Arial","sans-serif";color:black;mso-fareast-language:DE'><a href="http://www.aos-stade.de/"><span lang=DE style='color:blue'>http://www.aos-stade.de</span></a></span><span style='font-size:12.0pt;font-family:"Times New Roman","serif";color:black;mso-fareast-language:DE'><o:p></o:p></span></p></div></body></html>