On 15 Jan 2014, at 08:27, Hachmer, Tobias <Tobias.Hachmer@stadt-frankfurt.de> wrote:
-----Ursprüngliche Nachricht----- Von: freeradius-users-bounces+tobias.hachmer=stadt-frankfurt.de@lists.freeradius.org [mailto:freeradius-users-bounces+tobias.hachmer=stadt-frankfurt.de@lists.freeradius.org] Im Auftrag von Arran Cudbard-Bell Gesendet: Dienstag, 14. Januar 2014 18:58 An: FreeRadius users mailing list Betreff: Re: feature request: ldap enhancements
On 14 Jan 2014, at 16:16, Alan DeKok <aland@deployingradius.com> wrote:
The dynamic clients code already handles this. I'd suggest instead ensuring that the dynamic clients can have ranges, and not just IP addresses. Simpler, and more flexible.
Done... In theory. On v3.0.x and master. If you just wanted to add ranges, use a combination of dynamic clients and the LDAP bulk load.
Thanks for the update. Yes, this is also a good resolution.
How do I have to use the new internal FR attribute FreeRADIUS-Client-IP-Prefix? For my understanding I have to create ldap objects with rdn cn=IP-Prefix like cn=10.0.1.0/24. What way is the matching done?
If your subnets are fixed size and on the octets boundaries, use a regex and the LDAP wildcard operator. If your subnets are a fixed size but not on octets boundaries I can add an xlat function to zero out the host bits: update control { Tmp-Ip-Address-0 := "%{ipprefix:%{Packet-Src-IP-Address}/<cidr>}" } If they're a limited range of sizes then the solution above could work, just add additional prefixes to the filter for your standard subnet sizes. If they're arbitrary sizes then this solution won't work well For actually retrieving the data you could use (yet another) instance of rlm_ldap with a different configuration, or ldap xlat and pull each client attribute from the directory one at a time. Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2