Hi Phil, Thank You for the response. Your input helps a lot. I did the modifications you suggested but the fetching of the variable is done too late. When the checking of the group is done, the %{control:Ldap-UID} comes empty, but is fetched later. If you see bellow the freeradius output. There could be a possibility that %{control:Ldap-UID} be filled before the group test? Thank You again. [ldap] Entering ldap_groupcmp() [files] expand: ou=people,DC=home,DC=net -> ou=people,DC=home,DC=net [files] expand: %{Stripped-User-Name} -> [files] ... expanding second conditional [files] expand: %{User-Name} -> test01 [files] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=test01) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to localhost:389, authentication 0 [ldap] bind as cn=admin,dc=home,dc=net/test123 to localhost:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in ou=people,DC=home,DC=net, with filter (uid=test01) [ldap] ldap_release_conn: Release Id: 0 [files] expand: (uniquemember=uidNumber=%{control:Ldap-UID},ou=people,dc=home,dc=net) -> (uniquemember=uidNumber=,ou=people,dc=home,dc=net) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in cn=group1,ou=group,dc=home,dc=net, with filter (uniquemember=uidNumber=,ou=people,dc=home,dc=net) [ldap] object not found [ldap] ldap_release_conn: Release Id: 0 rlm_ldap::ldap_groupcmp: Group cn=group1,ou=group,dc=home,dc=net not found or user is not a member. ++[files] returns noop [ldap] performing user authorization for test01 [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> test01 [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=test01) [ldap] expand: ou=people,DC=home,DC=net -> ou=people,DC=home,DC=net [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=people,DC=home,DC=net, with filter (uid=test01) [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] uidNumber -> Ldap-UID == 30001 <--------- here is fetched -------------- [ldap] userPassword -> Password-With-Header == "{SSHA}5Va5FraqFtiFvnYULYP9me/OxLN0lh4P" [ldap] looking for reply items in directory... [ldap] Setting Auth-Type = LDAP [ldap] user test01 authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop ________________________________ From: Phil Mayers [via FreeRadius] <ml-node+4379760-567345519-206427@n5.nabble.com> To: crzrobot <mateivan@yahoo.com> Sent: Sunday, 8 May 2011, 12:29 Subject: Re: ldap group filter On 05/08/2011 10:32 AM, crzrobot wrote:
Sry for the double posting. Hi, Recently I implemented an radius authentication using the ldap module. Next step is do control the users by groups and I want to ask how could i setup the group filter if i have this kind of configuration for the groups on the LDAP servers. I tried to google it but no luck with useful results. The user authentication is done by uid.
Thank You for your help
dn: cn=group1, ou=group,dc=home,dc=net objectclass: groupOfUniqueNames gidNumber: 30000 cn: group1 uniquemember: uidNumber=30001, ou=people,dc=home,dc=net uniquemember: uidNumber=30002, ou=people,dc=home,dc=net uniquemember: uidNumber=30003, ou=people,dc=home,dc=net
It's been a long time, but I think this is invalid LDAP data. The uniquemember value should be a valid DN. You probably could make this work in FreeRADIUS, but you should fix your LDAP schema. You'll need to do the following: 1. Define a local "uid" attribute in raddb/dictionary e.g. ATTRIBUTE Ldap-UID 3000 integer 2. Define a mapping in ldap.attrmap from LDAP to radius for the uid e.g checkItem Ldap-UID uidNumber 3. Update your group query e.g. groupmembership_filter = \ "(uniquemember=uidNumber=%{control:Ldap-UID},ou=people,dc=home,dc=net} ...but it's hacky and nasty - what if the path after the RDN varies? Fix your LDAP schema to be right and this will just work - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ________________________________ If you reply to this email, your message will be added to the discussion below:http://freeradius.1045715.n5.nabble.com/ldap-group-filter-tp4379112p4379760.... To unsubscribe from ldap group filter, click here. -- View this message in context: http://freeradius.1045715.n5.nabble.com/ldap-group-filter-tp4379112p4380082.... Sent from the FreeRadius - User mailing list archive at Nabble.com.