RE: RE : assigning vlan based on LDAP attribute

27 Sep 2006

      My ldap section from radiusd.conf looks like:
ldap {
                server = "ldapserver.net.org"
                identity = "uid=name,dc=net,dc=org"
                password = password
                basedn = "ou=stuffdc=net,dc=org"
                filter = "(uid=%{Stripped-User-Name:-%{User-Name}})"
                start_tls = no
                dictionary_mapping = ${raddbdir}/ldap.attrmap
                ldap_connections_number = 5
                password_attribute = userPassword
                groupmembership_attribute = eduPersonPrimaryAffiliation
                timeout = 4
                timelimit = 3
                net_timeout = 1
        }

My users file contains the following at the end:
DEFAULT Huntgroup-Name == myAP, Ldap-Group == staff
       User-Name=`%{User-Name}`,
       Tunnel-Medium-Type=IEEE-802,
       Tunnel-Private-Group-Id=2,
       Tunnel-Type=VLAN,
       Fall-Through = no

My huntgroups file has:
myAP            NAS-IP-Address == x.x.x.141

In my Debug I noticed that although I have them commented out of
radiusd.conf, I still see:
Debug:  ldap: groupname_attribute = "cn"
Debug:  ldap: groupmembership_filter =
"(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupO
fUniqueNames)(uniquemember=%{Ldap-UserDn})))"

You asked:
* is your AP accepting Tunnel-Private-Group-Id=2 (I've got AP which uses
other format).
How do I check that?

Thanks

Matt

-----Original Message-----
From: Thibault Le Meur [mailto:Thibault.LeMeur@supelec.fr] 
Sent: September 27, 2006 1:36 PM
To: mda@unb.ca
Cc: 'FreeRadius users mailing list'
Subject: RE : assigning vlan based on LDAP attribute
...
I'm a bit confused on this one.
I want my users vlan'd based on their affiliation (ie, staff, 
student) In my radiusd.conf file, under ldap, I've put:
groupmembership_attribute = eduPersonPrimaryAffiliation
That's a good start, but sending the whole ldap configuration section would
help.
...
Do I need to do more in my radiusd.conf file than that?
I think you hould check that you do not have groupname_attribute and
groupmembership_filter set.
...
I assume this means assign them to a group based on the value 
stored in the LDAP field eduPersonPrimaryAffiliation
I then added to my users file:
DEFAULT Huntgroup-Name == myAP, Ldap-Group == staff
       User-Name=`%{User-Name}`,
       Tunnel-Medium-Type=IEEE-802,
       Tunnel-Private-Group-Id=2,
       Tunnel-Type=VLAN,
       Fall-Through = no
There are several things to check here:
* is the NAS-IP-ADDRESS of the AccessPoint defined in the huntgroup "myAP"
in your huntgroups file ?
* is your AP accepting Tunnel-Private-Group-Id=2 (I've got AP which uses
other format).

The best way to check this is to stop your radius server and run it manually
with "radiusd -X".

Then send the debug log to the list (take care passwords are written
cleartext).
...
But this doesn't seem to work. My staff users do not get 
assigned to vlan 2. Do I need to make a huntgroup for myAP?
Of course... Unless you remove the "Huntgroup-Name == myAP," check item

HTH,
Thibault

RE: RE : assigning vlan based on LDAP attribute

Matt Ashfield