On Nov 30, 2021, at 6:25 AM, Diego Forcella <diego.forcella@c2group.it> wrote:
I am trying to set up a single freeradius with multiple ldap servers to query. The goal is to have a single freeradius server authenticating users from different tenants.
Ex: user@domain1.com must use only the ldap domain1 {} configuration user@domain2.com must use only the ldap domain2 {} configuration
I configured the file /etc/freeradius/3.0/mods-available/ldap in order to have the 2 configurations ldap domain1 {} and ldap domain2 {} and the bind is correct
That's good.
The problem is that when I run a radtest the user is searched for both on domain1 and on domain2 and then the result is returned only for domain2 because it is the last one that is queried.
Because you listed both modules in the authorization section as: authorize { ... domain1 domain2 ... } The server doesn't know that the "domain1" module is for domain1.com. You have to tell it.
I would like that if I make a query, domain1 or domain2 is used based on the suffix of the user I am querying
$ man unlang You can do regular expression matches on the User-Name: if (User-Name =~ /@domain1.com/) { domain1 } elsif (User-Name =~ /@domain2.com/) { domain2 } Alan DeKok.