Thanks for reply! I have solved my attempt to set VLAN-Group-ID based on checkItem by insert this line in post-auth section of 'sites-available/default' -- $INCLUDE ${confdir}/setTunnelGroup -- In the file setTunnelGroup I insert this: -- if (reply:SectionNetwork == "sec11") { update reply { Tunnel-Private-Group-ID :=111 } } -- In file 'dictionary' I add this line: -- ATTRIBUTE SectionNetwork 4000 string -- In file 'ldap.attrmap' I add this line: -- replyItem SectionNetwork sectionNetwork -- @ Phil: My problem is that the value of ldap-attribute is not correspond to the vlan name in our cisco switch at this time. LG Michael Am 13.09.2010 16:10, schrieb Alan DeKok:
Michael Bathe wrote:
is there any how_to or solution to interpret the ldap checkItem and change the replyItem (I think in inner-tunnel)? f.e.: If the checkItem match one of 'sec11', 'Sec11', 'SEC11'... the replyItem should be set to '111'.
$ man unlang
The ldap module doesn't do generic comparison or setting of attributes. Neither does the "users" file.
But the "unlang" policy language does.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Michael Bathe Rechenzentrum -Netzwerkadministration- Tel.: +49 (0)331/288-1803 Fax: +49 (0)331/288-1730 Email: michael.bathe@gfz-potsdam.de ___________________________________ Helmholtz-Zentrum Potsdam Deutsches GeoForschungsZentrum - GFZ Stiftung des Öff. Rechts Land Brandenburg Telegrafenberg G257, D-14473 Potsdam