Elizabeth Steinke wrote:
> I tested this rule with radtest (Making the necessary modifications  and
> it worked fine.
>
> DEFAULT Huntgroup-Name = "vpn-pix",Ldap-Group = "CN=somevpn...",
> Auth-Type := ntlm_auth_plaintext
> DEFAULT Huntgroup-Name = "vpn-pix",Ldap-Group != "CN=somevpn...",
> Auth-Type := Reject

 Then it's fine.

> Is it a good idea to force the auth-type in the users file? is there a
> cleaner way to do this?

 If it works... it's fine.

 The big rants about not forcing Auth-Type are because of the people
who force it without understanding the consequences... and then complain
when it doesn't work.

> While rewriting the rules file I am pairing accept and denies as above.
> Is that necessary or will it turn out to be horribly inefficient?

 It's good practice.  But doing all of those LDAP-Group queries can get
expensive.  i.e. you're doing *two* queries instead of one.

 You could fix this with "unlang":

       if (Huntgroup-Name == "vpn-pix") {
               if (LDAP-Group == ...) {
                       update control {

                               Auth-Type := ntlm_auth_plaintext
                       }
               }

               else {
                       reject
               }

       }

 Only one LDAP-Group check is more efficient.

 Alan DeKok.
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html