there are more in the LDAP server in your profile store dn 1.add a radiusprofile objectclass 2.add radiusProfiledn set its values with its own dn 3.add radiusReplyItem attribute add the first value: Reply-Message += "Welcome administrator %{User-Name}" add the second value: Huawei-Exec-Privilege := 15 and then valuepair_attribute = "radiusReplyItem" this setting will retrieve radiusReplyItem's values and add to raidius reply section. that all. On 03/18/2016 05:05 PM, MichaelLeung wrote:
hope this could he more people
On 03/18/2016 04:55 PM, MichaelLeung wrote:
finially, i config out how it works
first, edit mods-available/ldap in global section add:
valuepair_attribute = "radiusReplyItem"
in profile section uncommecnt and change the default values profile { default = "%{control:User-Profile}" }
go to policy.d/ directory create a policy , whatever your name it whatevername { if (Ldap-Group == "groupname in LDAP, or DN") { update { $control:User-Profile == "profile dn in LDAP" } updated } else { reject } }
go to site-available/ directory
edit the virtual server you want
in the authorize section
add the policy in to it
On 03/18/2016 02:07 PM, MichaelLeung wrote:
i find this in wiki.freeradius.org
LDAP ATTRIBUTES
In version 2, the mapping between RADIUS attributes <http://wiki.freeradius.org/protocol/Attributes> and LDAP <http://wiki.freeradius.org/protocol/LDAP> attributes is in raddb/ldap.attrmap. You can edit that file and add any new mapping that you may need. The LDAP-schema file is located in doc/RADIUS-LDAPv3.schema. Before adding any radius attributes the ldap server schema should be updated.
All ldap entries containing radius attributes should contain at least "objectclass: radiusprofile"
radiusCheckItem and radiusReplyItem are special. They allow the administrator to add any check or reply item respectively without adding it in the ldap schema. The format should be:
ldap-attribute: radius-attribute operator value
The version 3 attribute mapping is in the module configuration file |raddb/mods-available/ldap|
For Example:
radiusReplyItem: Cisco-AVPair := "ip:addr-pool=dialin_pool"
but i dont understand , if we mapping the radius attr and ldap attr, then give it a values , why do we stored the replyitem in LDAP.
On 03/18/2016 01:46 PM, MichaelLeung wrote:
does freeradius 3.0.4 still have ldap.attrmap ?
On 03/18/2016 12:46 PM, MichaelLeung wrote:
how can i get radiusReplyItem from LDAP?
On 03/18/2016 09:25 AM, MichaelLeung wrote:
any help ?
On 03/17/2016 05:31 PM, MichaelLeung wrote: > any reply ? > > On 03/17/2016 03:20 PM, MichaelLeung wrote: >> well , i define a ldap-group check policy >> >> # >> devicemanager_check { >> if (Ldap-Group == "DeviceManager") { >> update reply { >> &User-Profile := >> "cn=DeviceManager,ou=Admin,ou=Group,dc=gd,dc=quantum-info,dc=com" >> } >> } >> elsif (Ldap-Group == "Device_Write") { >> update reply { >> &Reply-Message += "Welcome,Device Operator" >> } >> } >> elsif (Ldap-Group == "Device_Reivew") { >> update reply { >> &Reply-Message += "Welcome Device Reviewer" >> } >> } >> else { >> update reply { >> &Reply-Message += "you are not >> authorized to access , please confirm that you have the >> permission..." >> } >> reject >> } >> } >> >> i am not sure that user override the User-Profile or not. >> >> >> On 03/17/2016 10:56 AM, MichaelLeung wrote: >>> hi list >>> >>> my freeradius version is 3.0.4 >>> >>> i have enabled ldap modules and the radius profile feature of it . >>> >>> and i need to check the user is in the speacific Ldap-Group, >>> and assign the User-Profile which contain all radius >>> Reply-Items in it . >>> so when my NAS try to authenticate , i can only see radius >>> -X responding : >>> (0) Sending Access-Accept packet to host 10.1.1.13 port 1812, >>> id=96, length=0 >>> (0) User-Profile := >>> 'cn=Device_Superior,ou=Admin,ou=Group,dc=gd,dc=abc,dc=com' >>> it was not going to print out what reply item the User-Profile >>> contained. >>> and actually, i define the reply item as >>> Huawei-Exec-Privilege := "15" >>> it will give the highest admin right to the user belong to >>> Group Device_Superior to Operate the Device . >>> >>> how can i debug the User-Profile? >> >