-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 All: I am running FreeRADIUS version 1.1.2 on Debian Linux (Stable x86). I am trying to map an LDAP attribute to a RADIUS attribute. A little background, we have a RADIUS client that needs to make decisions based on an LDAP attribute (we'll call it User-Category). Based on the value of this attribute the end user will be given rights on the network. So, I setup my ldap.attrmap with *only* the following line: replyItem User-Category orgPrimaryAffiliation I setup the following config for rlm_ldap: server = "ldapserver.org.com" identity = "cn=Radius_admin,ou=Special Users,dc=org,dc=com" password = 12345 basedn = "dc=org,dc=com" filter = "(&(objectclass=*) (orgShortid=%{Stripped- User-Name:-%{User-Name}}))" base_filter = "(objectclass=*)" # port = 636 port = 389 The following debug logs show the successful authentication of the user and the mapping of the attributes: rad_recv: Access-Request packet from host 127.0.0.1:32904, id=192, length=58 User-Name = "mytestuser" User-Password = "12345" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "mytestuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_ldap: - authorize rlm_ldap: performing user authorization for mytestuser radius_xlat: '(&(objectclass=*) (orgShortid=mytestuser))' radius_xlat: 'dc=org,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=org,dc=com, with filter (& (objectclass=*) (orgShortid=mytestuser)) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Adding orgPrimaryAffiliation as User-Category, value student & op=11 rlm_ldap: Setting Auth-Type = ldap rlm_ldap: user mytestuser authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 4 modcall: leaving group authorize (returns ok) for request 4 rad_check_password: Found Auth-Type ldap auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group LDAP for request 4 rlm_ldap: - authenticate rlm_ldap: login attempt by "mytestuser" with password "12345" rlm_ldap: user DN: orgUUID=53d66879-e0a0- da8f-4c49-514b567713ad,ou=People,dc=org,dc=com rlm_ldap: (re)connect to ldapserver.org.com:389, authentication 1 rlm_ldap: bind as orgUUID=53d66879-e0a0- da8f-4c49-514b567713ad,ou=People,dc=org,dc=com/12345 to ldapserver.org.com:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user mytestuser authenticated succesfully modcall[authenticate]: module "ldap" returns ok for request 4 modcall: leaving group LDAP (returns ok) for request 4 Sending Access-Accept of id 192 to 127.0.0.1 port 32904 Finished request 4 The problem is that I never see the RADIUS server return the "User- Category" attribute back to the RADIUS client. It seems to only want to send the "Access-Accept" or "Access-Reject" message with no User- Category value. I tried including the "User-Category" in the request with no luck. I also modified the "attrs" file to include this attribute: DEFAULT Service-Type == Framed-User, Service-Type == Login-User, Login-Service == Telnet, Login-Service == Rlogin, Login-Service == TCP-Clear, Login-TCP-Port <= 65536, Framed-IP-Address == 255.255.255.254, Framed-IP-Netmask == 255.255.255.255, Framed-Protocol == PPP, Framed-Protocol == SLIP, Framed-Compression == Van-Jacobson-TCP-IP, Framed-MTU >= 576, Framed-Filter-ID =* ANY, Reply-Message =* ANY, User-Category =* ANY, Proxy-State =* ANY, Session-Timeout <= 28800, Idle-Timeout <= 600, Port-Limit <= 2 But no luck there either. Any help is greatly appreciated. Thank You, Paul - -- Paul Asadoorian Email: paul@pauldotcom.com Web: http://pauldotcom.com IRC: #pauldotcom | irc.freenode.net Fingerprint: 2693 0204 8497 2E5F 4853 11D5 1153 6151 487F E094 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.1 (Darwin) iD8DBQFEvjotEVNhUUh/4JQRAqM/AKCWYfgBERhaBQ/xKUDMGD552JPB4QCfTP+v knyeEwAg7Annq9xXcdwK8s0= =Gzks -----END PGP SIGNATURE-----