On 20 Mar 2015, at 10:16, Ben Humpert <ben@an3k.de> wrote:
2015-03-20 2:15 GMT+01:00 Matthew Newton <mcn4@leicester.ac.uk>:
Try the rlm_ldap page: http://wiki.freeradius.org/modules/Rlm_ldap "Group Support".
If you've already followed the part from the mac auth docs about getting Called-Station-SSID, you should be able to do something like
if (Called-Station-SSID == "guest") { if (Ldap-Group == "guestgroup") { noop } else { reject } }
or similar, to accomplish what you want.
Thank you very much for posting that example. I got what I wanted to archive working. However, it feels like a very dirty hack. Isn't there a better way (maybe in newer versions)?
if (Ldap-Group == Called-Station-SSID) { } It's not really clear what you're trying to do...
2.1.12 is ancient and has plenty of bugs and security issues. If you really want to use it, you're probably better off going to Ubuntu for help. Long term "support" should mean that...
Building 2.2.6 on Debian is absolutely trivial. http://wiki.freeradius.org/building/Build#Building-Debian-packages
Having said that, unlang like the above will /probably/ be OK on that version. But noone around here is particularly interested, as you've found out :)
If I would use 2.2.6 wouldn't I have to use the same configuration as I have to use in 2.1.12 or it there are easier and more modular way to implement what I want to archive?
Currently I have to "hardcode" every group into the configuration file and everytime I add/remove a group I have to edit the file and restart Radius. It's like Radius without LDAP. I thought of something like
if (%{tolower:%{Ldap-Group}} == %{Called-Station-Ssid}) { noop } else { reject }
In version 3 you can use LDAP group caching, and the multivalue selector. if (&LDAP-Group[*] == &Called-Station-Id) { } Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2