On Tue, Mar 30, 2021 at 6:56 PM Braden McGrath via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
Have you considered using nested ifs to query twice for the "network-admins AND $othergroup" scenario? If you're concerned about LDAP load / query time, you can enable caching in the ldap module; then the LDAP-Group list is saved and lookups happen against the cache instead of being re-queried each time you ask for it.
using a complicated series of ANDs is something we hope to not have to fall back on due to complexity. Let's say there were 5 groups: * 3 groups for 'network' layer2/3 * 2 groups for 'optical' layer1 .. there's 31 combinations of 5 items, meaning 31 IF statements, which is unruly. Thanks for the caching tip, unsure if this is currently enabled but will do so! On Wed, Mar 31, 2021 at 2:14 AM Michael Schwartzkopff <ms@sys4.de> wrote:
If the user is member of multiple groups, the LDAP-Group is a Attribute-List (=Array).
see the man pages of unlang.
I used LDAP-Group array checks to select VPN connections. Please see
https://blog.sys4.de/strongswan-vpn-based-on-groups-en.html
for my solution. Hope my ideas can help you.
Very helpful thank you. I haven't used "case" before- since it's in a switch, in the link above, you mention " have to use the switch / case structure since a user can be member of multiple groups". Does this mean that the switch/case statement will update the reply for *all* matching cases, not just the first hit? If so this is exactly what I'm looking for, but my brain assumed, due to the "switch", that the first hit would win and it would stop processing after that. --Chris