Hi Phil,

Thank You for the response. Your input helps a lot.

I did the modifications you suggested but the fetching of the variable is done too late. When the checking of the group is done, the %{control:Ldap-UID} comes empty, but is fetched later. If you see bellow the freeradius output.

There could be a possibility that %{control:Ldap-UID} be filled before the group test?

Thank You again.

[ldap] Entering ldap_groupcmp()

[files] expand: ou=people,DC=home,DC=net -> ou=people,DC=home,DC=net

[files] expand: %{Stripped-User-Name} ->

[files] ... expanding second conditional

[files] expand: %{User-Name} -> test01

[files] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=test01)

[ldap] ldap_get_conn: Checking Id: 0

[ldap] ldap_get_conn: Got Id: 0

[ldap] attempting LDAP reconnection

[ldap] (re)connect to localhost:389, authentication 0

[ldap] bind as cn=admin,dc=home,dc=net/test123 to localhost:389

[ldap] waiting for bind result ...

[ldap] Bind was successful

[ldap] performing search in ou=people,DC=home,DC=net, with filter (uid=test01)

[ldap] ldap_release_conn: Release Id: 0

[files] expand: (uniquemember=uidNumber=%{control:Ldap-UID},ou=people,dc=home,dc=net) -> (uniquemember=uidNumber=,ou=people,dc=home,dc=net)

[ldap] ldap_get_conn: Checking Id: 0

[ldap] ldap_get_conn: Got Id: 0

[ldap] performing search in cn=group1,ou=group,dc=home,dc=net, with filter (uniquemember=uidNumber=,ou=people,dc=home,dc=net)

[ldap] object not found

[ldap] ldap_release_conn: Release Id: 0

rlm_ldap::ldap_groupcmp: Group cn=group1,ou=group,dc=home,dc=net not found or user is not a member.

++[files] returns noop

[ldap] performing user authorization for test01

[ldap] expand: %{Stripped-User-Name} ->

[ldap] ... expanding second conditional

[ldap] expand: %{User-Name} -> test01

[ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=test01)

[ldap] expand: ou=people,DC=home,DC=net -> ou=people,DC=home,DC=net

[ldap] ldap_get_conn: Checking Id: 0

[ldap] ldap_get_conn: Got Id: 0

[ldap] performing search in ou=people,DC=home,DC=net, with filter (uid=test01)

[ldap] No default NMAS login sequence

[ldap] looking for check items in directory...

[ldap] uidNumber -> Ldap-UID == 30001 <--------- here is fetched --------------

[ldap] userPassword -> Password-With-Header == "{SSHA}5Va5FraqFtiFvnYULYP9me/OxLN0lh4P"

[ldap] looking for reply items in directory...

[ldap] Setting Auth-Type = LDAP

[ldap] user test01 authorized to use remote access

[ldap] ldap_release_conn: Release Id: 0

++[ldap] returns ok

++[expiration] returns noop

++[logintime] returns noop

From: Phil Mayers [via FreeRadius] <[hidden email]>
To: crzrobot <[hidden email]>
Sent: Sunday, 8 May 2011, 12:29
Subject: Re: ldap group filter

On 05/08/2011 10:32 AM, crzrobot wrote:

> Sry for the double posting.
> Hi,
> Recently I implemented an radius authentication using the ldap module.
> Next step is do control the users by groups and I want to ask how could i
> setup the group filter if i have this kind of configuration for the groups
> on the LDAP servers. I tried to google it but no luck with useful results.
> The user authentication is done by uid.
>
> Thank You for your help
>
> dn: cn=group1, ou=group,dc=home,dc=net
> objectclass: groupOfUniqueNames
> gidNumber: 30000
> cn: group1
> uniquemember: uidNumber=30001, ou=people,dc=home,dc=net
> uniquemember: uidNumber=30002, ou=people,dc=home,dc=net
> uniquemember: uidNumber=30003, ou=people,dc=home,dc=net
>

It's been a long time, but I think this is invalid LDAP data. The
uniquemember value should be a valid DN.

You probably could make this work in FreeRADIUS, but you should fix your
LDAP schema.

You'll need to do the following:

1. Define a local "uid" attribute in raddb/dictionary e.g.

ATTRIBUTE Ldap-UID 3000 integer

2. Define a mapping in ldap.attrmap from LDAP to radius for the uid e.g

checkItem Ldap-UID uidNumber

3. Update your group query e.g.

groupmembership_filter = \
"(uniquemember=uidNumber=%{control:Ldap-UID},ou=people,dc=home,dc=net}

...but it's hacky and nasty - what if the path after the RDN varies? Fix
your LDAP schema to be right and this will just work
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

If you reply to this email, your message will be added to the discussion below:

http://freeradius.1045715.n5.nabble.com/ldap-group-filter-tp4379112p4379760.html

To unsubscribe from ldap group filter, click here.