On Jan 14, 2016, at 10:04 AM, Thomas Stather <Thomas.Stather@mpimf-heidelberg.mpg.de> wrote:
I have a RADIUS setup (eduroam) where the users are authenticated against LDAP (mod_ldap, not ntlm_auth) for our own domain. All other users are proxied to a RadSec proxy. This works fine, but now we need the possibility to replace the Aruba-User-VLAN VAP with a different VLAN ID, if some users from our domain can be found in a special LDAP group (i.e. cn=testgroup). If not, the users should get assigned the Aruba-User-VLAN VAP 31.
What do i have to change in my setup in order to make this work?
Write down the rules in procedural form. Then translate them to unlang. if (my realm) { if (ldap group == test group ) { VLAN VAP 31 } else { VLAN VAP } } It's really that simple. Alan DeKok.