I added this to the users file
DEFAULT ldap1.REALM-2.ca-Ldap-Group == residential_profile
But I get this error when I fire up radius -X
/etc/raddb/users[222]: Parse error (check) for entry DEFAULT: expecting operator Errors reading /etc/raddb/users
Wild guess, but you might try a simpler module name e.g. "ldap2" instead of "ldap2.some.dots-and.hyphens". Phil I gave that a try but ended up with the same result. Chris I was able to get this working by adding that ldap instance to the instantiate section of radius.conf. I can do a query successfully from LDAP now and pull the group info, but during the query I am seeing first a failed query then a successful query how could I go about fixing this? I believe it's the groupmembership_filter settings but I left them to the default values which seems to be the consensus on the mailing list. ############ radius -X output ######### [REALM1] Entering ldap_groupcmp() [files] expand: ou=radius,o=realm1.ca,dc=company,dc=ca -> ou=radius,o=realm1.ca,dc=company,dc=ca [files] expand: (|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=))(&(objectClass=GroupOfUniqueNames)(uniquemember=))) [REALM1] ldap_get_conn: Checking Id: 0 [REALM1] ldap_get_conn: Got Id: 0 [REALM1] performing search in ou=radius,o=realm1.ca,dc=company,dc=ca, with filter (&(cn=residential_profile)(|(&(objectClass=GroupOfNames)(member=))(&(objectClass=GroupOfUniqueNames)(uniquemember=)))) [REALM1] object not found [REALM1] ldap_release_conn: Release Id: 0 [REALM1] ldap_get_conn: Checking Id: 0 [REALM1] ldap_get_conn: Got Id: 0 [REALM1] performing search in uid=112boy,ou=radius,o=realm1.ca,dc=company,dc=ca, with filter (objectclass=*) rlm_ldap::ldap_groupcmp: User found in group residential_profile [REALM1] ldap_release_conn: Release Id: 0 ################################### ### Group section of LDAP module ##### groupname_attribute = cn groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" groupmembership_attribute = radiusGroupName ######################################### ##### LDAP entry for an account I am querying against ###### dn: uid=112boy,ou=radius,o=realm1.ca,dc=company,dc=ca uid: 112boy userPassword: XXXX objectClass:top objectClass: posixAccount objectClass: radiusProfile uidNumber: 1100 gidNumber:1100 radiusSimultaneousUse: 099 radiusAuthType: PAP homeDirectory: // radiusGroupName: residential_profile cn: TRUE ########################################### I do get a successful query I would just like to figure out how to get it to resolve on the first attempt. Thanks, Chris -----Original Message----- From: freeradius-users-bounces+chris.taylor=corp.eastlink.ca@lists.freeradius.org [mailto:freeradius-users-bounces+chris.taylor=corp.eastlink.ca@lists.freeradius.org] On Behalf Of Phil Mayers Sent: Tuesday, February 05, 2013 11:23 AM To: freeradius-users@lists.freeradius.org Subject: Re: LDAP groups and profiles On 05/02/13 15:50, Chris Taylor wrote:
I added this to the users file
DEFAULT ldap1.REALM-2.ca-Ldap-Group == residential_profile
But I get this error when I fire up radius -X
/etc/raddb/users[222]: Parse error (check) for entry DEFAULT: expecting operator Errors reading /etc/raddb/users
Wild guess, but you might try a simpler module name e.g. "ldap2" instead of "ldap2.some.dots-and.hyphens". - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html