<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7638.1">
<TITLE>multiattribute testing in git 1411859</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/rtf format -->
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">Hi,</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri"> </FONT></SPAN><SPAN LANG="en-gb"> <FONT FACE="Calibri">I saw the thread</FONT></SPAN><SPAN LANG="en-gb"> <FONT FACE="Calibri">“</FONT></SPAN><SPAN LANG="en-gb"><FONT FACE="Calibri">multi-valued ldap-group attributes in rlm_cache</FONT></SPAN><SPAN LANG="en-gb"><FONT FACE="Calibri">” and figured that FR has been sorted to have multivalued attribute lookups in it now.</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">I may be completely wrong but thought I’d test it anyway.</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">I’ve got a simple case where I look up groups in ldap (AD 2008)</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">mods-enabled/ldap</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">[..]</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">update {</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri"> control:Ldap-MemberOf += 'memberOf'</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">}</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">.. and then a policy which takes the first value before the comma from the ldap group set that comes back</FONT></SPAN><SPAN LANG="en-gb"><FONT FACE="Calibri">:</FONT></SPAN><SPAN LANG="en-gb"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">ldap-memberof-filter-regexp="^CN=([^,]*)"</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri"> ldap-memberof-filter {</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri"> update control {</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri"> Tmp-String-0 !* ANY</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri"> }</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri"> foreach control:Ldap-MemberOf {</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri"> if ("%{Foreach-Variable-0}" =~ /${policy.ldap-memberof-filter-regexp}/) {</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri"> update control {</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri"> Tmp-String-0 += "%{1}"</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri"> }</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri"> }</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri"> }</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri"> update control {</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri"> Ldap-MemberOf !* ANY</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri"> }</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri"> foreach control:Tmp-String-0 {</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri"> update control {</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri"> Ldap-MemberOf += "%{Foreach-Variable-0}"</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri"> }</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri"> }</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri"> update control {</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri"> Tmp-String-0 !* ANY</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri"> }</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri"> }</FONT></SPAN><SPAN LANG="en-gb"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">.. this works ok</FONT></SPAN><SPAN LANG="en-gb"><FONT FACE="Calibri">, and the “stripped” group name is processed</FONT></SPAN><SPAN LANG="en-gb"><FONT FACE="Calibri"> and</FONT></SPAN><SPAN LANG="en-gb"> <FONT FACE="Calibri">listed back</FONT></SPAN><SPAN LANG="en-gb"><FONT FACE="Calibri"> to the original attribute name.</FONT></SPAN><SPAN LANG="en-gb"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">I’d then expect to</FONT></SPAN><SPAN LANG="en-gb"> <FONT FACE="Calibri">be able to</FONT></SPAN><SPAN LANG="en-gb"> <FONT FACE="Calibri">add it to the cache as per Arran’s</FONT></SPAN><SPAN LANG="en-gb"> <FONT FACE="Calibri">suggestion</FONT></SPAN><SPAN LANG="en-gb"><FONT FACE="Calibri"> from the thread</FONT></SPAN><SPAN LANG="en-gb"><FONT FACE="Calibri"> where he says</FONT></SPAN><SPAN LANG="en-gb"><FONT FACE="Calibri">:</FONT></SPAN><SPAN LANG="en-gb"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">>></FONT></SPAN><SPAN LANG="en-gb"><FONT FACE="Calibri">update {</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">>></FONT></SPAN><SPAN LANG="en-gb"> <FONT FACE="Calibri">control:ldap_xyz-Ldap-Group += &ldap_xyz-Ldap-Group[*] }</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">>></FONT></SPAN><SPAN LANG="en-gb"><FONT FACE="Calibri">So now, essentially:</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">>></FONT></SPAN><SPAN LANG="en-gb"><FONT FACE="Calibri">&ldap_xyz-Ldap-Group[0] and &ldap_xyz-Ldap-Group</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">>></FONT></SPAN><SPAN LANG="en-gb"><FONT FACE="Calibri">are synonymous in terms of update blocks, not matter what the operator is.</FONT></SPAN><SPAN LANG="en-gb"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">So I do:</FONT></SPAN><SPAN LANG="en-gb"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">update {</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri"> control:Ldap-MemberOf += &control:Ldap-MemberOf[*]</FONT></SPAN><SPAN LANG="en-gb"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">}</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">.. but it either stops the server output when it’s populating the cache – no segfault, just stops on that line and needs ctrl-c.</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">Or it goes into a loop:</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">(1) cache : Ldap-MemberOf += 'SSID_SaTH_Guest-Virgin-PRH'</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">(1) cache : Ldap-MemberOf += 'SSID_SaTH_Guest-Virgin-PRH'</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">(1) cache : Ldap-MemberOf += 'SSID_SaTH_Guest-Virgin-PRH'</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">(1) cache : Ldap-MemberOf += 'SSID_SaTH_Guest-Virgin-PRH'</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">(1) cache : Ldap-MemberOf += 'SSID_SaTH_Guest-Virgin-PRH'</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">.. and also needs ctrl-c.</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">Also,</FONT></SPAN><SPAN LANG="en-gb"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">If I didn’t fill the cache and had a section that said something like</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">If (&control:Ldap-MemberOf [*] == “something”) {</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">..</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">Should it pick up all instances now</FONT></SPAN><SPAN LANG="en-gb"><FONT FACE="Calibri"> in the check</FONT></SPAN><SPAN LANG="en-gb"><FONT FACE="Calibri">? It only seems to act on the first one still.</FONT></SPAN><SPAN LANG="en-gb"> <FONT FACE="Calibri">I also tried</FONT></SPAN><SPAN LANG="en-gb"> <FONT FACE="Calibri">“%{control:Ldap-MemberOf[*]”, but that does the same.</FONT></SPAN><SPAN LANG="en-gb"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">Again maybe my misinterpretation.</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">I also briefly tried the ldap cache enabling and shared</FONT></SPAN><SPAN LANG="en-gb"><FONT FACE="Calibri"> load balance redundant way of checking each ldap server (cache_attribute)</FONT></SPAN><SPAN LANG="en-gb"> <FONT FACE="Calibri">but it only seems to pick up the first attribute still:</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">Mods-enabled/ldap</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">[..]</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">Ldap ldap1 {</FONT></SPAN><SPAN LANG="en-gb"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri"> </FONT></SPAN><SPAN LANG="en-gb"> <FONT FACE="Calibri">Group {</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri"> </FONT></SPAN><SPAN LANG="en-gb"> <FONT FACE="Calibri"> cacheable_name = yes</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri"> cache_attribute = "Cached-Ldap-Group"</FONT></SPAN><SPAN LANG="en-gb"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">[..]</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">(1)</FONT></SPAN><SPAN LANG="en-gb"> <FONT FACE="Calibri">ldap1 : Added control:Cached-Ldap-Group with value "SSID_SaTH_Guest-Virgin-PRH"</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">(1) ldap1 : Added control:Cached-Ldap-Group with value "SSID_RSH_WiFi"</FONT></SPAN><SPAN LANG="en-gb"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">(1)</FONT></SPAN><SPAN LANG="en-gb"> <FONT FACE="Calibri">if (&control:Cached-Ldap-Group[*] == "SSID_RSH_WiFi")</FONT></SPAN><SPAN LANG="en-gb"><FONT FACE="Calibri"> </FONT></SPAN><SPAN LANG="en-gb"> <FONT FACE="Calibri">-> FALSE</FONT></SPAN><SPAN LANG="en-gb"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">..</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">(</FONT></SPAN><SPAN LANG="en-gb"><FONT FACE="Calibri">1)</FONT></SPAN><SPAN LANG="en-gb"> <FONT FACE="Calibri">if</FONT></SPAN><SPAN LANG="en-gb"> <FONT FACE="Calibri">(</FONT></SPAN><SPAN LANG="en-gb"><FONT FACE="Calibri">&control:Cached-Ldap-Group[*] == "SSID_SaTH_Guest-Virgin-PRH")</FONT></SPAN><SPAN LANG="en-gb"><FONT FACE="Calibri"> -></FONT></SPAN><SPAN LANG="en-gb"><FONT FACE="Calibri"> TRUE</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">..</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">Maybe my testing is premature. Quite happy to keep testing if required!</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">Thanks</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT FACE="Calibri">Andy</FONT></SPAN><SPAN LANG="en-gb"></SPAN></P>
</BODY>
</HTML>