When I upgraded from 1.1.7 to 2.0.5, my group-checking rules stopped working. By running FreeRadius in debug mode, I noticed that the filters it was constructing to do the group-membership check were incorrect. My configuration had this (in modules/ldap): groupmembership_filter = "(&(objectClass=groupOfNames)(member=%{Ldap-UserDn}))" But the debug output had this: expand: (&(objectClass=groupOfNames)(member=%{Ldap-UserDn})) -> (&(objectClass=groupOfNames)(member=)) Apparently, in this version, the syntax of %{Ldap-UserDn} should now be %{control:Ldap-UserDn}. Thanks to Alan DeKok for letting me know. I have verified that this worked. The attached patch updates the documentation to show the correct syntax, and fixes the default value in rlm_ldap.c. --- doc/rlm_ldap | 4 ++-- raddb/modules/ldap | 2 +- src/modules/rlm_ldap/rlm_ldap.c | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/doc/rlm_ldap b/doc/rlm_ldap index 32f7e8e..56467b6 100644 --- a/doc/rlm_ldap +++ b/doc/rlm_ldap @@ -232,9 +232,9 @@ the rlm_ldap module: # groupmembership_filter: The filter to search for group membership of a # particular user after we have found the DN for the group. # -# default: (|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn}))) +# default: (|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn}))) # -# groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" +# groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn})))" # groupmembership_attribute: The attribute in the user entry that states diff --git a/raddb/modules/ldap b/raddb/modules/ldap index 1f0ff88..a330214 100644 --- a/raddb/modules/ldap +++ b/raddb/modules/ldap @@ -126,7 +126,7 @@ ldap { # Group membership checking. Disabled by default. # # groupname_attribute = cn - # groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" + # groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn})))" # groupmembership_attribute = radiusGroupName # compare_check_items = yes diff --git a/src/modules/rlm_ldap/rlm_ldap.c b/src/modules/rlm_ldap/rlm_ldap.c index b127417..bb2be91 100644 --- a/src/modules/rlm_ldap/rlm_ldap.c +++ b/src/modules/rlm_ldap/rlm_ldap.c @@ -280,7 +280,7 @@ static const CONF_PARSER module_config[] = { {"groupname_attribute", PW_TYPE_STRING_PTR, offsetof(ldap_instance,groupname_attr), NULL, "cn"}, {"groupmembership_filter", PW_TYPE_STRING_PTR, - offsetof(ldap_instance,groupmemb_filt), NULL, "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))"}, + offsetof(ldap_instance,groupmemb_filt), NULL, "(|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn})))"}, {"groupmembership_attribute", PW_TYPE_STRING_PTR, offsetof(ldap_instance,groupmemb_attr), NULL, NULL},