Thanks very much Phil. That works, I think it doesn't work in the hints file for the reasons you told me.<br><br>Now I've got a new problem. I use the radiusGroupName for making the users belong to VLAN1, VLAN2 or VLAN3. So I enable 
<br>&nbsp;&nbsp;&nbsp;&nbsp; <br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; groupmembership_attribute = radiusGroupName<br><br>but I left groupname_attribute and groupmembership_filter commented ( in each ldap module ).<br><br>In other file called users-vlan I defined this:<br>
<br>&nbsp;&nbsp; DEFAULT Ldap-Group == Local<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; stuff for assigning VLAN1<br>&nbsp;&nbsp; .....<br>The file that determine the users procedence is users-procedence:<br><br>&nbsp;&nbsp; DEFAULT NAS-IP-Address == 192.168.51.yy, Autz-Type=customer1
<br>&nbsp;&nbsp; .....<br><br>The file that proxies ( users-proxy ):<br>&nbsp;&nbsp; DEFAULT proxy-to-realm:=CENTRAL<br><br>The authorization section:<br>....<br>users-procedence<br>autztype customer1{<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; redundant {<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; group {
<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ldap1 {
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; notfound = return<br><div>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; fail = return<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; users-vlan
<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; mschap
<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; eap<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; notfound = 1<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; fail = 1<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; users-proxy<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }
<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }
</div>.....<br><br><br>The situation is: a user that must be authorized against ldap2 make a match in the users-procedence file and get customer2 autztype. So the user is looked for in ldap2. <br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 1.- If it fails in the logs I could see radius looking for ldap_groupcmp() in ldap3 when all I think it must do is proxy. 
<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 2.- In case the user is found it make a search too for ldap group in ldap3.<br><br>I think in the first case there are two problems: it searches when it doesn't have to ( unnecessary search ), and it searches bad because it does in the last ldap instantiated ( that is ldap3 )
<br><br>In the second case the problem is that it searches in the last ldap instantiated.<br><br>(( This configuration works fine when all you have is one ldap ))<br><br>Is that a bug ?? I found a similar bug in bug-list but it belongs to version 
1.0.1 ( bug #163, about unnecessary searches ) and I think a read a bug about searching in the last ldap instantiated ( but I think this has to be with older versions and I can't find it )<br><div><span class="gmail_quote">
<br>I solved this problem yesterday but I don't know how to say... I solved it in a dirty-way ( I hope you understand ). So if you or anyone have an idea ...<br><br><br><br><br><br>2006/6/5, Phil Mayers &lt;<a href="mailto:p.mayers@imperial.ac.uk">
p.mayers@imperial.ac.uk</a>&gt;:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">wekz wrote:<br>&gt;<br>&gt; I don't know if I have explain it correctly, if I haven't just tell me (
<br>&gt; I'm not an english speaker )<br><br>Your english is great.<br><br>&gt; My hints file:<br><br>Nearly there. Try:<br><br>DEFAULT NAS-IP-Address == 192.168.xx.yy, Autz-Type := LDAPx<br><br>I'm not sure that'll work in a hints file - so you may need to use a
<br>&quot;users&quot; file - hints puts items into the request pairs, Autz-Type needs<br>to go into the configure pairs.<br><br>Try this:<br><br>modules {<br>&nbsp;&nbsp; # other stuff<br>&nbsp;&nbsp; files filesFirst {<br>&nbsp;&nbsp;&nbsp;&nbsp; usersfile = ${confdir}/usersFirst
<br>&nbsp;&nbsp; }<br>}<br><br>authorize {<br>&nbsp;&nbsp; preprocess<br>&nbsp;&nbsp; filesFirst<br>&nbsp;&nbsp; Autz-Type LDAP1 {<br>&nbsp;&nbsp;&nbsp;&nbsp; # stuff here<br>&nbsp;&nbsp;&nbsp;&nbsp; ldap1<br>&nbsp;&nbsp; }<br>&nbsp;&nbsp; # other LDAP modules<br>}<br><br>And in ${confdir}/usersFirst:<br><br>DEFAULT NAS-IP-Address == 
192.168.51.xx, Autz-Type := LDAP1<br><br>DEFAULT NAS-IP-Address == 192.168.51.yy, Autz-Type := LDAP2<br><br>...and so on.<br><br>The other slightly simpler way might be to use a &quot;passwd&quot; (badly named)<br>module, 
e.g.:<br><br>modules {<br>&nbsp;&nbsp; passwd nas2autz {<br>&nbsp;&nbsp;&nbsp;&nbsp; filename = ${confdir}/nas2autz<br>&nbsp;&nbsp;&nbsp;&nbsp; format = &quot;*NAS-IP-Address:Autz-Type&quot;<br>&nbsp;&nbsp;&nbsp;&nbsp; # set to 0 to read file on every request - slow<br>&nbsp;&nbsp;&nbsp;&nbsp; # but instant-updates
<br>&nbsp;&nbsp;&nbsp;&nbsp; hashsize = 100<br>&nbsp;&nbsp; }<br>}<br><br>authorize {<br>&nbsp;&nbsp; preprocess<br>&nbsp;&nbsp; nas2autz<br>&nbsp;&nbsp; Autz-Type LDAP1 {<br>&nbsp;&nbsp;&nbsp;&nbsp; ldap1<br>&nbsp;&nbsp; }<br>&nbsp;&nbsp; # other Autz<br>}<br><br>...and in ${confdir}/nas2autz<br><br>192.168.51.xx:LDAP1
<br>192.168.51.yy:LDAP2<br><br>Hope that helps<br>Phil<br>-<br>List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html">http://www.freeradius.org/list/users.html</a><br></blockquote></div><br>