Attached is a git format patch which adds support for storing clients in LDAP. The necessary schema can be found in doc/examples/389_ds_schema.ldif. This is schema ldif file suitable for use with 389-ds (the standard LDAP server shipped with Fedora and RHEL which over the years with different versions has been known under a variety of names, Netscape Directory Server, iPlanet, Sun Directory Server, Red Hat Directory Server, Fedora Directory server). The patch was against the 2.1.10 branch. Here are a few quick notes. * Its had only light testing, but seems to work O.K. It should probably be tested in different with different combinations of client specification. * I did add support for COA, but that's not tested. * When I was looking at the schema I noticed the OID's which are being used (in each of the schema files I looked at) are not registered and do not belong to FreeRADIUS (they belong to the GNOME name space and I believe the reason for that is GNOME had a block of OID's and for expediency they were "borrowed"). I did not update the other ldap schema files in the patch, the new schema should be reviewed first. The new attributes and object classes should then be merged into the other schema files. * The code to parse a client IP address is now duplicated in three places in the server, in client.c when reading the clients file, in rlm_sql.c and rlm_ldap.c. The code should probably be refactored so there is a common subroutine to do this. * The schema should be reviewed. One thing was immediately came to my mind was case sensitivity, right now the matching rules are case insenstive. Also the strings are defined to be ASCII (actually IA5). Perhaps the strings should be UTF-8 case sensitive. But that's less important than making sure the right attributes and object classes are defined and their naming makes sense. * The attribute names are hard coded in the source, but that's consistent with how the rest of rlm_ldap works, but that does mean you're tied to using the supplied schema. * I followed the existing indentation (each indent level is a tab character) which I personally dislike (I would prefer to see an indent of 4 spaces). I added a emacs configuration comment so anyone who opens the files with emacs will end up indenting with a tab character just so it stays consistent. FWIW rlm_ldap needs some love in other places, possibly a minor rewrite, formatting can be addressed then. Have fun, hope this helps ... John -- John Dennis <jdennis@redhat.com> Looking to carve out IT costs? www.redhat.com/carveoutcosts/