On 03.07.21 23:14, Yann Verry via Freeradius-Users wrote:
Dear list,
My first time I write on the mailing-list. I hope not boring or not already answered thousand of times.
I would like to setup a classical radius with rlm_ldap authentication module. The auth works as expected when I add attribute on the user side OR in profile section with the default value.
LDAP should not be used for authentication but for authorization. FreeRADIUS can do the authentication better than the backend LDAP.
My question is, how I can handle vlan with group dynamicaly. I seen some response/thread that put each group in post-auth {}.
You have to cache the LDAP-Group attribute and use this attribute later in processing to assign the correct VLAN. Perhaps you can get the idea from my blog. It is not exactly about assigning VLAN IDs, but I use the LDAP-Group to assign the CLass attribute. https://blog.sys4.de/strongswan-vpn-based-on-groups-en.html
But I would like to have all information / matching from LDAP directly not in config file.
Yes, you cannot use the ldap config file from RADIUS since this is only responisble for retrieving the info from LDAP server. Assingning the VLAN attribute has to be done later in processing.
Do you have some input / docs to do this ?
My current setup:
Michael Mit freundlichen Grüßen, -- [*] sys4 AG https://sys4.de, +49 (89) 30 90 46 64 Schleißheimer Straße 26/MG,80333 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Marc Schiffbauer, Wolfgang Stief Aufsichtsratsvorsitzender: Florian Kirstein