On 18/01/12 16:04, suggestme wrote:
There are different users under Staff, Administrators, Retirees, etc in active directory as:
OU=Staff OU=Administrators OU=Retirees CN=users CN=users CN=users
Ok, so you want to look at the "OU" in the DN. The "ldap" module sets the value "Ldap-UserDN". You can match this. This is easiest in "unlang". For example, in sites-enabled/<name>: authorize { ... ldap # match the 2nd part of the DN with a regexp # e.g. # CN=foo,OU=bar,CN=com if (Ldap-UserDN =~ /^[^,]+,OU=([^,]+),/) { # store the regexp match in the control list update control { # This will be set to "bar" Tmp-String-1 := "%{1}" } } ... } post-auth { # now, read the value of Tmp-String-1 update reply { Filter-Id := "Enterasys:version=1:policy=%{control:Tmp-String-1}" } }