On Tue, 2014-05-27 at 20:37 +0100, Arran Cudbard-Bell wrote:
Without code patches you'd need to add radiusreplyItem attributes directly to the groups objects. The group objects and the profile objects would be one and the same.
Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
what you say contradicts what you have stated previously: Groups don't return replyItems only profiles do. Groups are only used for checking membership, they cannot contain attributes themselves. Note that your profile attribute could be the same as your group attribute i.e. memberOf, in which case you'd just need to add the group objects to the radiusprofile object. am i to understand that 3.0.3 changes things or have i again missed something important? originally, i had the group configured with the objectclass and the radiusreplyitem attribute, and that did not provide the authorization string in the reply. without undoing the radiusprofiledn and the radiusprofile existing elsewhere in the directory, i added back the radiusreplyitem to the group and tested with radtest. i do not see the string in the reply from radiusd. as soon as i see the 3.0.3 update in the fedora repos, i will be updating to it. maybe that will clear up some of these loose ends.