On 6/10/19 7:20 AM, Adam Bishop wrote:
I'm having an issue with ldap group checking where FreeRADIUS appears to bail out early if it encounters a group DN it can't resolve.
I ran into this exact issue.
Can I get it to continue reading the list of groups if it fails to resolve one, or is this intended (or something I've screwed up in the config)?
Check the comments for group/membership_attribute in mods-available/ldap: # Unless a conversion between group name and group DN is # needed, there's no requirement for the group objects # referenced to actually exist. I was able to prevent radiusd from trying to resolve the group by using the group's complete DN in sites-available/default, rather than just the group name. So instead of: if (LDAP-Group == "lab_admins") { update reply { Cisco-AVPair := "shell:priv-lvl=15" } } I have: if (LDAP-Group == "cn=lab_admins,cn=groups,cn=accounts,dc=...") { update reply { Cisco-AVPair := "shell:priv-lvl=15" } }
(3) Debug: if (&LDAP-Group[*] == "%{client:ldap_group}") { (3) Debug: EXPAND %{client:ldap_group} (3) Debug: --> switching-admins
If you can get %{client:ldap_group} to expand to the group's full DN (or even manually "munge" it) radiusd shouldn't try to resolve the group. HTH -- ======================================================================== Ian Pilcher arequipeno@gmail.com -------- "I grew up before Mark Zuckerberg invented friendship" -------- ========================================================================