On Mar 31, 2017, at 2:53 PM, Aaron Dalla-Longa <aaron@shortgrass.ca> wrote:
Freeradius version 3
Is it possible to deny a user based on an attribute that LDAP sends through, and if so, what is the syntax for it?
You can map LDAP attributes to RADIUS ones. See raddb/mods-available/ldap. Look for "mapping".
Alternatively, if there is a well-put together guide on Freeradius LDAP syntax, could you link it to me?
The wiki has lots of documentation. Please go there and look. It also has a searchable interface. Just search for LDAP.
Something that I would be looking for would be something like the pseudo-code below:
if (user_attribute "delinquency" == "no") { accept { else { reject }
That's not LDAP, that's unlang policies. And those are documented, too. Lots of examples, and a "man unlang" page that describes the syntax. Alan DeKok.