thanks for your replay here what i did in the ldap.attrmap i put checkItem User-Category eduPersonPrimaryAffiliation in the user file i did DEFAULT Tunnel-Type := VLAN, Tunnel-Medium-Type := IEEE-802, Tunnel-Private-Group-Id = 901, Fall-Through = Yes DEFAULT User-Category == "student" Reply-Message = "Your a member of the student Group", Tunnel-Private-Group-Id = 902 DEFAULT User-Category == "employee" Reply-Message = "Your a member of the employee Group", Tunnel-Private-Group-Id = 903 in the inner-tunnel file i have authorize { chap mschap uni suffix update control { Proxy-To-Realm := LOCAL } eap { ok = return } ldap files expiration logintime pap } i got the following logs ........ [eap] EAP packet type response id 7 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [ldap] performing user authorization for doutrele [ldap] expand: %{Stripped-User-Name} -> doutrele [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=doutrele) [ldap] expand: dc=int-evry,dc=fr -> dc=int-evry,dc=fr [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=int-evry,dc=fr, with filter (uid=doutrele) [ldap] looking for check items in directory... [ldap] eduPersonPrimaryAffiliation -> User-Category == "employee" [ldap] sambaNtPassword -> NT-Password == 0x3846343134354531463530334232353337443430363846343942363633434143 [ldap] sambaLmPassword -> LM-Password == 0x4434413632394242394536303843323438423045413541374446313335423033 [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user doutrele authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok [files] users: Matched entry DEFAULT at line 166 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Normalizing NT-Password from hex encoding [pap] Normalizing LM-Password from hex encoding [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [eap] Freeing handler ++[eap] returns ok ...... THe line 166 in my users file is these ones DEFAULT Tunnel-Type := VLAN, Tunnel-Medium-Type := IEEE-802, Tunnel-Private-Group-Id = 901, Fall-Through = Yes and i don't match the following entries DEFAULT User-Category == "employee" Reply-Message = "Your a member of the employee Group", Tunnel-Private-Group-Id = 903 and i really don't know why Le 16/09/2010 09:44, Phil Mayers a écrit :
[ldap] expand: dc=int-evry,dc=fr -> dc=int-evry,dc=fr [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to ldapdev.int-evry.fr:389, authentication 0 [ldap] bind as cn=admin,dc=int-evry,dc=fr/admldap to ldapdev.int-evry.fr:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in dc=int-evry,dc=fr, with filter (uid=doutrele) [ldap] looking for check items in directory... [ldap] sambaNtPassword -> NT-Password == 0x3846343134354531463530334232353337443430363846343942363633434143 [ldap] sambaLmPassword -> LM-Password == 0x4434413632394242394536303843323438423045413541374446313335423033 [ldap] looking for reply items in directory... [ldap] eduPersonPrimaryAffiliation -> User-Category = "employee"
Two issues; first, as above you're adding the User-Category item from LDAP into the reply list, but the "files" syntax doesn't (can't) match items in the reply this. This:
DEFAULT User-Category == "employee"
means "match all request with the attribute User-Category == employee in the *request* items"
Secondly, I think you're running LDAP after "files", so even if it could match, it would not.
Try something like this in sites-available/inner-tunnel:
authorize { ... ldap if (reply:User-Category == employee) { update reply { Tunnel-Private-Group-Id := 1234 } } elsif (reply:User-Category == ...) { }
}
Or, modify your ldap.attrmap to put the User-Category into the request items (assuming your NAS doesn't need it) then move the files module after the ldap one.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html