Re: ldap filter and cert-subject

25 Aug 2020

      On Aug 25, 2020, at 10:38 AM, Sandmann, David <david.sandmann@uni-greifswald.de> wrote:
...
Is it possible to extract the uid from „TLS-Client-Cert-Subject
:=  C=DE/../../UID=username“
Yes.  You can just use a regular expression.

	 if (TLS-Client-Cert-Subject =~ /UID=(.*)/) {
		update control {
			Stripped-User-Name = "%{1}"
		}
	}

  If you don't want to use Stripped-User-Name, just edit raddb/dictionary, and define a local 'string' attribute there
...
in mods-enabled/ldap -> filters?
Edit the filters to use Stripped-User-Name, or whatever else you defined above.

  Alan DeKok.