Dude, if it's this easy that would be SWEET! The How To's for TLS/PEAP are a little outdated so I'm working on getting the CA working now (CA.all doesn't exist anymore.) I'm ALL over this ASAP! Thanks! Gary -----Original Message----- From: freeradius-users-bounces+ggatten=waddell.com@lists.freeradius.org [mailto:freeradius-users-bounces+ggatten=waddell.com@lists.freeradius.or g] On Behalf Of Jason Alderfer Sent: Tuesday, August 18, 2009 2:18 PM To: FreeRadius users mailing list Subject: Re: Dynamic VLAN attribute in LDAP or AD?
So, I'm trying to use 802.1x dynamic VLAN assignment. I have this working when I conf the "users" file. However, I don't want to create/maintain the users file for 2,000 users!
Is there an attribute in AD / LDAP I can use for the dynamic VLAN? Ideally I could do this at the "Group" level, such that when a user moves from one group to another their automagically assigned to the correct VLAN.
If you're using version 2.0.5 or higher you can do this with unlang as follows. This example sets the vlan based on the user's DN, but you should be able to modify it to look at your group membership attribute. Repeat for all relevant ldap groups. if (control:Ldap-UserDn =~ /ou=div,o=org/i) { update reply { Tunnel-Type := "VLAN" Tunnel-Medium-Type := "IEEE-802" Tunnel-Private-Group-Id := 9 } } - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>