Hi,

Is there some way to configure ldap at radius to read only object classes and not groups? To allow or reject the access to some destination?

Eg.

  groupname_attribute = cn

  groupmembership_filter = "(&(objectClass=posixGroup)(memberUid=%{User-Name})(objectclass=brEduPerson))” Is there some way to configure ldap at radius to read only object classes and not groups? To allow 


My LDAP server does not have groups, so I can’t use the above… how can I get some object classes? Instead of groups? Like (search logs in debug down):

uid=69327181034

brEduAffiliation

                                brEntranceDate: 20091008

brEduAffiliation: 1

brEduAffiliationType: employee

objectClass: brEduPerson

 

uid=02494605059

                brEduAffiliation=1

                               brEntranceDate: 20120110

brEduAffiliation: 1

brEduAffiliationType: student

objectClass: brEduPerson


The search returns this:

Wed Dec 11 14:18:44 2013 : Info: +- entering group post-auth {...}

Wed Dec 11 14:18:44 2013 : Info: ++? if (LDAP-Group == "student")

Wed Dec 11 14:18:44 2013 : Debug:   [ldap] Entering ldap_groupcmp()

Wed Dec 11 14:18:44 2013 : Info: expand: ou=people,dc=DOMAIN,dc=EDU -> ou=people,dc=DOMAIN,dc=EDU

Wed Dec 11 14:18:44 2013 : Info: expand: (&(objectClass=posixGroup)(memberUid=%{User-Name})(objectclass=brEduPerson)) -> (&(objectClass=posixGroup)(memberUid=74879995053)(objectclass=brEduPerson))

Wed Dec 11 14:18:44 2013 : Debug:   [ldap] ldap_get_conn: Checking Id: 0

Wed Dec 11 14:18:44 2013 : Debug:   [ldap] ldap_get_conn: Got Id: 0

Wed Dec 11 14:18:44 2013 : Debug:   [ldap] performing search in ou=people,dc=DOMAIN,dc=EDU, with filter (&(cn=student)(&(objectClass=posixGroup)(memberUid=74879995053)(objectclass=brEduPerson)))

Wed Dec 11 14:18:44 2013 : Debug:   [ldap] object not found

Wed Dec 11 14:18:44 2013 : Debug:   [ldap] ldap_release_conn: Release Id: 0

Wed Dec 11 14:18:44 2013 : Debug: rlm_ldap::ldap_groupcmp: Group student not found or user is not a member.

Wed Dec 11 14:18:44 2013 : Info: ? Evaluating (LDAP-Group == "student") -> FALSE


Thank You