Greetings! Thanks! ok that explains alot. Here is a more detailed explanation of the problem. We are using an arubawireless AP Management station to connect wireless clients. XP-->Peap-->MSCHAPV2--> FreeRadius --> NTLM_AUTH,RLM_LDAP The authentication works just dandy. The Aruba allows us to do role based firewalling. The documentation says you can use "any" radius attribute and pass it to the aruba and then use that in the server rule to perform actions on ie: assign to a vlan or do privilege escalation etc... Since NTLM_Auth handles the authentication, I was hoping to use LDAP to either obtain a list of groups ie: memberOf from the ADS server (Which I was able to do but it returns multiples and I wasnt able to get it so strip the cn= from the results, also it appears it cant be a multiword value :) or to just use an attribute returned from the LDAP server ie: RadiusGroup and have it passed to the NAS so it can apply it's rules. Ldap --> Radius -->Nas Is it possible to use NTLM_Auth and then use LDAP to search for a value returning it to the aruba? Are the only values available to be used in this way the ones listed in the dictionary file for the Aruba? I have ordered the O'reilly book and hopefully it will give me clue +10 :) I Really appreciate the help! Thanks! Liz On Apr 5, 2006, at 9:16 PM, Alan DeKok wrote:
liz <liz@unixgrrl.net> wrote:
I have a simple question about the ldap.attrmap file. I have placed the following two lines into my ldap.attrmap.file. ... checkItem Group-Name Description replyItem Group-Name Description
You are trying to re-define attributes that have existing definitions in the server. Don't do that. Create a new attribute, instead.
What I am trying to do is obtain information from an attribute in the LDAP server and then pass it to the NAS we are using.
In which case you have to pick an attribute the NAS understands. Group-Name is not an attribute any NAS understands.
a) Is this approriate use of the ldap.attrmap file
No.
b) Is there any easier way to do this.
It depends on what you want to do.
c) What should I see when it succefsully sends an attribute to the NAS.
You should see the attribute in the reply, in debugging mode.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/ users.html