Am I correct in saying that the LDAP-attribute that is mapped to Tunnel-Private-Group-ID would need to be set to the value of the the VLAN I require? The LDAP-attribute that I wish to use curently contains values like "ITISCP" and "ENISCP". I want to say if attribute value == ITISCP set vlan to 226 (ie Tunnel-Private-Group-ID = 226). Using ldap.attrmap mappings I would need to store the required vlan in a LDAP attribute. (I can't change the LDAP only read it).
No. You can define your own attribute (let's say VLAN-Flag) in raddb/dictionary and use unlang in authorize section to test and set tunnel attributes.
Thanks Ivan,
I've configured a dictionary value "userORGUNIT" and added a ldap.attrmap mapping. I've tried to perform a comparison operation on the value of userORGUNIT in the config file: users.
i.e DEFAULT userORGUNIT == "HR" Tunnel-Private-Group-Id = "226"
But this does not match, even though debug shows "rlm_ldap: Adding userORGUNIT as userORGUNIT, value HR & op=21"
Is this the correct location for these comparison operations? There are around 50 userORGUNIT''s that I need to compare against.
Files are normally listed before ldap in authorize. Use unlang switch command *after* ldap entry. Or list files after ldap if you are using an old version. Ivan Kalik Kalik Informatika ISP