Luo, Frank Y.F. Mr. wrote:
I have a senario, no ldap schema extension is wanted ( no ldap group or profile is wanted); we do use ldap authentication though; and it works fine. after authentication, we need to check one ldap attribute like "vpn" and and return "class: ou={ldap vpn value}" back to the radius client (the cisco concentrator).
So in the sites_avaiable/default, I have this
post-auth { update reply { class = "ou=%Profile" }
Well, that's wrong. See "man unlang" for documentation. And the Profile attribute doesn't exist.
and in ldap.attrmap, i have
replyItem Profile VPN
There must a syntax error on how to refer a ldap attribute value here. since what I got is this
# Executing section post-auth from file /opt/freeradius/etc/raddb/sites-enabled/default +- entering group post-auth {...} WARNING: Unknown variable '%P': See 'doc/variables.txt'
And WHAT is unclear about that message? Did you bother to READ the file "doc/variables.txt"?
Any clue how to implement this?
The server is telling you to read documentation. Go read it. The answers are there. See also "man unlang" You've managed to make a number of different mistakes in the config. And then compounded that by NOT reading the documentation that tells you how to fix those mistakes. Alan DeKok.