On 9 Sep 2014, at 11:35, Stefan Paetow <Stefan.Paetow@ja.net> wrote:
I am wondering if I can set up FreeRadius to send back the LDAP groups that a user is a member of. Authentication with LDAP should use the username.
Yes.
Is it possible to get FreeRadius to query the LDAP server to find the groups associated with that username, then send this group list back to the connecting user in the Access- Accept message?
Yes.
Will this require a plugin?
No. You can do this in the inner-tunnel (if you use EAP) and return the attribute(s) to the outer reply. You can either use an ldap xlat to retrieve information in the post-auth section (use ldapsearch to get your query right, then plug it into an ldap xlat (i.e. Attribute := "%{ldap:<ldapquery here>}"), or you can set up the ldap module right from the start, and it'll retrieve everything in one go. :-)
That's only possible if you have memberOf attributes contained within the userObject. If you have group objects with lists of members, then you'll need version 3.0.x, and use the cacheable_name/cacheable_dn toggles. cacheable_name will store the names of the groups, and cacheable_dn will store the DNs of the groups. In either case, using v3.0.x LDAP and the cacheable_* code, is more efficient. If you are using memberOf attributes, it will combine the lookup for group info with retrieving other attributes from the user object, so everything is done as one search. -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2