I want LDAP-Group to be included in the accounting-request START packet before its forwarded to the center radius. Nabawia On Fri, Nov 26, 2010 at 5:48 AM, westwood <yczxwestwood@gmail.com> wrote:

Does received packet Accounting-Request (stop type) include Attribute LDAP-Group ?

2010/11/26 Nabawia Khalil <nabawiak@gmail.com>

...

...

I am using freeradius to authenticate my users through my LDAP.

I'm forwarding the accounting to a central radius.

I want to include the LDAP-Group to the accounting data.

Do any know how to include this field in the accounting data ??

If any one has a similar experience to include an item (such as Class field) let me know, and I can try it with my LDAP-Group

NK

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html

Dear Alan, How can I do this ?? Nabawia On Fri, Nov 26, 2010 at 11:41 AM, Alan DeKok <aland@deployingradius.com>wrote:

Nabawia Khalil wrote:

...

I want LDAP-Group to be included in the accounting-request START packet before its forwarded to the center radius.

The LDAP-Group attribute can *not* be put into a RADIUS packet.

If you want the same information put in a RADIUS Accounting packet, you will need to do the LDAP lookups during the "accounting" phase, and update a RADIUS attribute with that information.

Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html

alan, I configured My radius to do the ldap lookup for LDAP-Group in the authentication phase, because my authorization is based on groups. I want a help how to insert this in the accounting packet. The problem is not how to configure the LDAP lookup, but how to enable this field in the accounting request. Please don't reply with offending words, I don't want you or others to do me the configuration, I'm capable of it. The accounting documentation of freeradius is very permeative. Nabawia On Fri, Nov 26, 2010 at 12:47 PM, Alan DeKok <aland@deployingradius.com>wrote:

Nabawia Khalil wrote:

...

How can I do this ??

The server comes with documentation.

If you want someone to do your work for you, I'm sure there are contractors available on the net.

Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html

I need to forward the accounting data including the LDAP-Group to a traffic shaper appliance installed before our internet gateway.

From the accounting data, This appliance will allow a quota internet usage for each user according to its LDAP-Group category (student, faculty, admin, par timer, assistant,.....)

Nabawia On Fri, Nov 26, 2010 at 2:41 PM, Toledo, Luis Carlos <lscrlstld@gmail.com>wrote:

...

I want a help how to insert this in the accounting packet. The problem is not how to configure the LDAP lookup, but how to enables field in the accounting request.

what is the purpose of that? What you want or need?

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html

Dear luis, Here is a small logical graph of my configuration, my NAS is my WS controller, and my traffic shaper can only receive accounting date forwarded to it from my radius. The radius did the authorization according to LDAP-Group received from the LDAP We want the traffic shaper to apply policy on users according to the ldap-group of each user. The ldap-group is included as a replyitem in the authorization data. The traffic shaper can only listen to the accounting data of the radius, cannot act as NAS, and don't support a direct communication with the LDAP. We are searching for a way to append ldap-group to the accounting data before it is forwarded to the traffic shaper. [image: Radius-ldap.jpg] On Fri, Nov 26, 2010 at 3:15 PM, Toledo, Luis Carlos <lscrlstld@gmail.com>wrote:

Noop...

you have a conceptual design problem of in your project...

Usually the NAS receives the network parameters in auth reply packet, and allow or disallow access, bandwidth, session time, etc.

Acct packet only store the usage data.

Your appliance must acct as NAS.

...

I need to forward the accounting data including the LDAP-Group to a traffic shaper appliance installed before our internet gateway.

From the accounting data, This appliance will allow a quota internet usage for each user according to its LDAP-Group category (student, faculty, admin, par timer, assistant,.....)d

Nabawia

...

I want a help how to insert this in the accounting packet. The problem is not how to configure the LDAP lookup, but how to enables field in the accounting request. what is the purpose of that? What you want or need?

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html

Nabawia Khalil wrote:

I configured My radius to do the ldap lookup for LDAP-Group in the authentication phase, because my authorization is based on groups.

Yes, I know. The problem is that authentication is *completely* independent of accounting.

I want a help how to insert this in the accounting packet. The problem is not how to configure the LDAP lookup, but how to enable this field in the accounting request.

Do the LDAP lookup when the accounting packet is received. Alan DeKok.