Hi Alan I RTM unlang, but I have to admit I only got confused - The only thing I have understood is to write a simple statement like this (in authorize section) if (NAS-Identifier == "ftp" ) { ok } else { reject } and I think is even wrong because returns always OK :((((( I noticed on some posts people using a syntax like if (NAS-Identifier == %{sql: SELECT ... BLA BLA} ) but I have not been able to see a working example using ldap, ... may you provide an example, please? I've not been able to figure out how to write it down. my situation is this: eckAllowedServices is a multistring attribute that contains a NAS-Identifier per line. I use service names as NAS- Identifiers in order to perform users authorization to services - eg authorize ftp access on a per users basis this is what happen when I do a ldapsearch ldapsearch -LLL -b cn=testuser,ou=Users,dc=marcolinux,dc=local eckAllowedServices -x -D "CN=FreeRADIUS,OU=AAA,OU=Services,DC=marcolinux,DC=local" -w wRtEYnd3sGkEa.Y4 dn: cn=testuser,ou=Users,dc=marcolinux,dc=local eckAllowedServices: ftp eckAllowedServices: httpProxy that shows that the DN used by freeradius is able to read eckAllowedServices attribute as I wrote in the previous post, I updated ldap.attrmap inserting the following line checkItem NAS-Identifier eckAllowedServices in order to do the "binding" between radius and LDAP and this is the extension of the LDAP schema (eck.schema) attributetype ( 1.3.6.1.4.1.26309.1.1.11 NAME 'eckAllowedServices' DESC 'Services the user is allowed to login' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{128} ) objectClass ( 1.3.6.1.4.1.26309.1.1.1 NAME 'eckGenericObject' AUXILIARY DESC 'an ECK generic object' MAY ( locked $ eckPublicKey $ eckPrivateKey $ userPKCS12 $ allowProxy $ eckAllowedServices)) thinking at the %{sql:SELECT ...} example I tough I syntax almost like this if (NAS-Identifier == "ldap:cn=%{User- Name},ou=Users,dc=marcolinux,dc=local (eckAllowedServices)" ) { ok } else { reject } the aim is to check if NAS-Identifier supplied by the NAS is equal to one of the multivalue strings of eckAllowedServices but I always got this message - it doesnt matter if the user has got or hasn't the eckAllowedServices attribute: if (NAS-Identifier == "ldap:cn=%{User- Name},ou=Users,dc=marcolinux,dc=local (eckAllowedServices)" ) expand: ldap:cn=%{User-Name},ou=Users,dc=marcolinux,dc=local (eckAllowedServices) -> ldap:cn=testuser,ou=Users,dc=marcolinux,dc=local (eckAllowedServices) ? Evaluating (NAS-Identifier == "ldap:cn=%{User- Name},ou=Users,dc=marcolinux,dc=local (eckAllowedServices)" ) -> FALSE ++? if (NAS-Identifier == "ldap:cn=%{User- Name},ou=Users,dc=marcolinux,dc=local (eckAllowedServices)" ) -> FALSE ++- entering else else {...} +++[reject] returns reject I gave a look to ldap.log - with verbose debugging, ... I found references to eckAllowedServices, but not as a request for only one attribute - as I was expecting for the unlang expression I wrote: I got it mixed with lots of other attributes - that is the previous ldap lookup of the ldap module of the authorization section: in other words - I think the unlang expression above is useless and is not processed with a query to the ldap server . I certainly mis-typed the syntax, but I'm not able to figure a syntax :((( Alan, may you provide an example unlang for LDAP? Maybe I am slow learner, but I think it could help me (and I hope others) a lot Ah - I use freeradius2-2.1.7-7.el5 - that is the "official" from RedHat/CentOS - please, don't tell me I have to repackage it to 2.1.10 - I had done this with quite a lot of other packages in ECK Il giorno 23/nov/10, alle ore 14:33, Alan DeKok ha scritto:
marco wrote:
Sorry Alan
I've not realized that the logs had became a garbage :O( - maybe a webmail realted issue of my ISP. Now I Bcc myself to see how does it appear to recipients
I tried "man unlang" but got no manual entry - I'm using Freeradius packaged for CentOS - I'll give a look to http://freeradius.org/radiusd/man/unlang.html , I think is the same.
<shrug> Upgrade to 2.1.10. You're using a very old version of the server.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html