Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:
then how is it correct to assign the profile? is syntax above correct?
That documentation wasn't updated for v3.0.x unfortunately.
thank you, Arran, for pointing that
If you wanted to use it you'd
I do know what I want, I have no any idea *how* to achieve that with FR :( I used users file only because I didn't find anything other ... I need to assign User-Profile ABC to each user who belongs to Ldap-Group ABC not the default profile for all users but only for ones who belongs to the group in the doc qoted in my previous post it is rather clear that it works via file users ... because of that I used namely that way ...
I'd try listing debug_control after calling the users file and seeing if the value for User-Profile appears there.
here it is: ---[ debug quotation start ]------------------------------------------- ... (7) files: Searching for user in group "wifi-abc" ... (7) files: User found in group object "ou=groups,ou=RADIUS,dc=xyz" rlm_ldap (ldap): Released connection (1) (7) files: users: Matched entry DEFAULT at line 78 (7) files: EXPAND %{User-Name}, SSID: %{Called-Station-SSID} access was permited and %{control:User-Profile} was assigned to you. (7) files: --> rad-visitor, SSID: ABC access was permited and was assigned to you. (7) [files] = ok (7) policy debug_control { (7) if ("%{debug_attr:control:}" == '') { (7) Attributes matching "control:" (7) &control:LDAP-UserDN = uid=rad-visitor,authorizedService=802.1x-eap-tls@xyz,uid=jdoe,ou=People,dc=xyz (7) &control:User-Profile := cn=wifi-abc,ou=profiles,ou=RADIUS,dc=xyz (7) EXPAND %{debug_attr:control:} (7) --> (7) if ("%{debug_attr:control:}" == '') -> TRUE (7) if ("%{debug_attr:control:}" == '') { (7) [noop] = noop (7) } # if ("%{debug_attr:control:}" == '') = noop (7) } # policy debug_control = noop rlm_ldap (ldap): Reserved connection (2) ... (7) ldap: Waiting for search result... (7) ldap: User object found at DN "uid=rad-visitor,authorizedService=802.1x-eap-tls@xyz,uid=jdoe,ou=People,dc=xyz" (7) ldap: Processing user attributes (7) ldap: control:Cleartext-Password := 'rad-visitor' (7) ldap: control:Password-With-Header += 'rad-visitor' rlm_ldap (ldap): Released connection (2) (7) [ldap] = updated ... ---[ debug quotation end ]------------------------------------------- so, at least it is there ... but still not assigned in file users I have this: ---[ file users quotation start ]------------------------------------------- ... DEFAULT Ldap-Group == "wifi-abc", Called-Station-SSID == "ABC", User-Profile := "cn=wifi-abc,ou=profiles,ou=RADIUS,dc=xyz" Fall-Through = no ... ---[ file users quotation end ]------------------------------------------- -- Zeus V. Panchenko jid:zeus@im.ibs.dn.ua IT Dpt., I.B.S. LLC GMT+2 (EET)