On Mon, Nov 10, 2014 at 2:26 PM, Alan DeKok <aland@deployingradius.com> wrote:
Nicolas Edel wrote:
Now I'd like to retrieve the attributes (in post-auth or other, no matter) from within the directory itself instead of hard-coding them in the radius configuration. This is not a show stopper but it would really help.
I don't think you can use an LDAP attribute to determine which *other* LDAP attribute to get RADIUS attributes from. That's very involved.
Perhaps you could explain what you're trying to do. Talking about problems is more useful than asking why a solution doesn't work. There may be other solutions to the problem which you haven't seen.
I have dozens of network machines (routers, switches, fw, etc.) that use radius auth. All users info on this network are stored into an LDAP directory. Each one may have access to some machines with differents rights (denied, readonly, etc). For each machine I must be able to define a custom profile (ie with custom radius attributes) for any user, but they usually have a predefined profile set. The reasons of making each predefined profiles as a plain ldap leaf are: - it avoid data duplication - the propagation of any change in one of a predefined profile becomes automatic Hope my explanations are clear enough ... :Nicolas