Alan DeKok <aland@deployingradius.com> wrote:
User-Profile is not assigned?
Because it doesn't assign User-Profile when doing LDAP group checks.
so, am I wrong to expect User-Profile assignment in case the user is the member of Ldap_Group, when `users' file contains that DEFAULT definition? DEFAULT Ldap-Group == ..., User-Profile := ... or, is it the only way to get User-Profile assigned according the Ldap-Group membership, to: post-auth { if (LDAP-Group == "LDAP Group One") { User-Profile := "cn=userprofile1,ou=profiles,ou=RADIUS,dc=xyz" } } then how is it correct to assign the profile? is syntax above correct?
in documentation it is written: if user is a part of Ldap-Group, the User-Profile will be assigned to the user.
What documentation says that?
FreeRADIUS Beginner's Guide by Dirk van der Walt, Published by Packt Publishing Ltd in 2011 p.113 heading "Ldap-Group and User-Profile AVP" ---[ quotation start ]------------------------------------------- ... Ldap-Group and User-Profile are usually paired together. First an LDAP search is done to check if a user is part of an Ldap-Group. If true, the specified User-Profile is assigned. If not true, the specified User-Profile is not assigned. Let's make use of it: 1. Edit the users file and add the following to the bottom: ... DEFAULT Ldap-Group == teachers, User-Profile := "cn=teachers,ou =profiles,ou=radius,dc=my-domain,dc=com" Fall-Through = no ... Let's look at some important points: ... * If the user is part of the Ldap-Group, the User-Profile will be assigned to the user. A User-Profile specified as a DN causes the ldap module to search for the DN during authorization: [ldap] performing search in cn=teachers,ou=profiles,ou=radius,d c=my-domain,dc=com, with filter (objectclass=radiusprofile) ... ---[ quotation end ]------------------------------------------- -- Zeus V. Panchenko jid:zeus@im.ibs.dn.ua IT Dpt., I.B.S. LLC GMT+2 (EET)