<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">i have a similar situation<div><br></div><div><div>$ sudo grep Profile dictionary </div><div>ATTRIBUTE<span class="Apple-tab-span" style="white-space:pre"> </span>Profile<span class="Apple-tab-span" style="white-space:pre"> </span>3000<span class="Apple-tab-span" style="white-space:pre"> </span>string</div></div><div><br></div><div><div>$ sudo grep Profile ldap.attrmap </div><div>replyItem<span class="Apple-tab-span" style="white-space:pre"> </span>Profile <span class="Apple-tab-span" style="white-space:pre"> </span>VPN</div></div><div><br></div><div><div><br></div><div>$ more default</div><div>.....</div><div>post-auth {</div><div>if (Profile == g1) {</div><div> update reply {</div><div> class = "ou=g1;"</div><div>}</div><div>}</div></div><div><br></div><div>But in the log</div><div><br></div><div><div># Executing section post-auth from file /opt/freeradius/etc/raddb/sites-enabled/default</div><div>+- entering group post-auth {...}</div><div>++? if (Profile == g1)</div><div> (Attribute Profile was not found)</div><div>? Evaluating (Profile == g1) -> FALSE</div><div>++? if (Profile == g1) -> FALSE</div></div><div><br></div><div><br></div><div>I also tried </div><div><br></div><div>If (reply:Profile == g1)</div><div><br></div><div>Any idea?</div><div><br></div><div>Thanks</div><div><br></div><div>Frank</div><div><br></div><div><br></div><div><br></div><div><br><div><div>On May 17, 2012, at 3:58 AM, C.F. Yeung wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">Thanks, it's working.<br><br><div class="gmail_quote">On Thu, May 17, 2012 at 3:22 PM, Phil Mayers <span dir="ltr"><<a href="mailto:p.mayers@imperial.ac.uk" target="_blank">p.mayers@imperial.ac.uk</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="im">On 05/17/2012 06:54 AM, C.F. Yeung wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
We have 802.1x authentication via AD. It's okay. Now, we would like to<br>
reject users based on LDAP attribute, WLANStatus. Added attribute in<br>
dictionary and ldap.attrmap as follow. Where should I put the unlang?<br>
<br>
/etc/raddb/dictionary<br>
ATTRIBUTE My-Local-wlanStatus 3000 string<br>
<br>
/etc/raddb/ldap.attrmap<br>
replyItem My-Local-wlanStatus WLANStatus<br>
<br>
</blockquote>
<br></div>
It's a REPLY item, so this should be:<br>
<br>
if (reply:My-Local-wlanStatus == A1) {<br>
...<br>
}<br>
-<br>
List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/<u></u>list/users.html</a><br>
</blockquote></div><br>
-<br>List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html">http://www.freeradius.org/list/users.html</a></blockquote></div><br></div></body></html>