I am running Freeradius 2.2.4 and am not quite sure where to go with this.  I have read the documentation, but my need does not quite match.

We have the standard EAP-PEAP setup where users are authenticated against AD via ntlm-auth.  What I need to do is add an authorization check to determine if a users should get a specific VLAN attribute sent back or be placed in a default VLAN (This is so we can only allow access to library resources to those that should be allowed).

Now, if I had a LDAP group that contained these I could use a simple group setup listed in the http://wiki.freeradius.org/modules/Rlm_ldap page.  My problem is, the attribute that contains the data about the affiliation is a multi valued attribute

UMICHINSTROLES
  • StudentAA, StudentDBRN, and StudentFLNT (continuing and incoming students regardless of enrollment; includes detached study);
  • EnrolledStudentAA, EnrolledStudentDBRN, EnrolledStudentFLNT (enrolled in at least one credit hour for ""current"" term; next term information is used during gap between terms)
  • AlumniAA, AlumniDBRN, AlumniFLNT (any person who has completed at least one semester in a degree-granting program)
  • FacultyAA, FacultyDBRN, FacultyFLNT (defined as academic, instructional, and research appointments; includes emeritus faculty)
  • RegularStaffAA, RegularStaffDBRN, RegularStaffFLNT (current appointment with a status of active, suspended, short-work break, leave, or paid leave);
  • TemporaryStaffAA, TemporaryStaffDBRN, TemporaryStaffFLNT (current appointment with a status of active, suspended, short-work break, leave, or paid leave)
  • Retiree (retired from any U-Mcampus, regardless of other appoints that may still be active)
  • SponsoredAffiliateAA, SponsoredAffiliateDBRN, SponsoredAffiliateFLNT (has at least one departmental sponsorship). 

    • Is there a way to make the group match a specific set of these values?  (I can do that with the Cisco VPN DAP policies)  Something along these lines (again based on group section from wiki)l

    post-auth {
        if (LDAP-Group == "umichinstroles=*FacultyAA") {
                Assign VLAN Special
        }
        elsif (LDAP-Group == "umichinstroles=*StudentAA") {
                Assign VLAN Special
    
        }
        else {
                Assign VLAN Default
    
        }
}

    Another path of thought was to specify a filter in the LDAP module config to something like this.

            filter = "(&(uid=%{Stripped-User-Name:-%{User-Name}})(|(umichinstroles=*AffiliateAA)(umichinstroles=*FacultyAA)(umichinstroles=*StudentAA)(umichinstroles=*StaffAA)))"

    So that works as far as only responding if a user matches one of those, but then how would I apply a VLAN for them and leave everyone else in a default VLAN?

    There must be a way to do this but my lack of LDAP knowledge is not helping me see how to do this and the guides I find do not seem help.

    Any help would be appreciated.
    ------------------------
    Walter Reynolds
    Principal Systems Security Development Engineer
    Information and Technology Services
    University of Michigan
    (734) 615-9438