On Thu, 2018-08-30 at 22:55 +0200, jehan procaccia int wrote:
I did that , but still fails with now the error :
(30) if (( &reply:User-Category == "employee") || (&reply:User- Category == "faculty") || (&reply:User-Category == "staff" ) || (&reply:User-Category == "researcher") || (&reply:User-Category == "member")) { (30) ERROR: Failed retrieving values required to evaluate condition (30) elsif ( (&reply:User-Category == "student" ) || (&reply:User-Category == "affiliate") ) { (30) ERROR: Failed retrieving values required to evaluate condition (30) else { (30) update reply { (30) Tunnel-Private-Group-Id := 902
So put debug_reply above that line and see if the attribute has been set there.
then it is still not clear wether my attribute is named User-Category or UserCategory (without "-") !?
Look in the dictionary. It is "User-Category".
and what's the difference between reply and &reply ?
&reply says to use the attribute value. In v2 you didn't need to say that. You should in v3 to save ambiguity.
/etc/raddb/sites-enabled/../vlanaffect.conf[3]: Unknown attribute 'UserCategory'
Because it's User-Category.
in mods-available/ldap I have the following mapping
ldap prod { update { reply:User-Category += 'eduPersonPrimaryAffiliation'
should (can ?) I rename :User-Category to :UserCategory here ?
No
is there a way to print the value of the an attribute to check it's *name* and*value* ?
debug_reply where do you set that ? I do see in policy.d/debug
Where you need to find out what the reply list contains. As above.
I use eduroam with peap mschapv2 (inner-tunnel) , maybe different radius packets are involved, it would be in my vlanaffec script that I would change reply with session-state ?
Change all reply:User-Category to session-state:User-Category. But find out whether it's set or not first. -- Matthew