Hi Alister, When I run LDAP query using the command line tool “ldapsearch” and I get the following output: # it section, People, icts.res.in dn: cn=it section,ou=People,dc=XXXX,dc=XXX,dc=XX objectClass: posixAccount objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: person objectClass: top objectClass: ieee802Device homeDirectory: /home/it loginShell: /bin/bash uid: it cn: it section uidNumber: 10001 gidNumber: 10000 sn: section givenName: it telephoneNumber: mobile: macAddress: 28:f1:0e:2a:c1:ac macAddress: e4:a4:71:a3:88:6f macAddress: 0c:c4:7a:22:63:23 Regards, -- Srinivas R On Wed, Sep 13, 2017 at 8:44 PM, Winfield, Alister <Alister.Winfield@sky.uk> wrote:
Do the LDAP query using the command line tool “ldapsearch”.
If you really have a multi-valued attribute with the right value(s) it should work.
I’d expect to see something like:
dn: cn=foo,dc=bar,dc=com cn: foo userServices: 00:01:02:03:04:05 userServices: 0a:0b:0c:0d:0e:0f userServices: aa:bb:cc:dd:ee:ff objectClass: …. …
In the output of the command line search.
Alister
On 13/09/2017, 12:26, "Freeradius-Users on behalf of Srinivasa R" <freeradius-users-bounces+alister.winfield=sky.uk@lists.freeradius.org on behalf of srinivasa.r@icts.res.in> wrote:
Hi Peter,
On Wed, Sep 13, 2017 at 2:51 AM, Peter Lambrechtsen <peter@crypt.nz> wrote:
> What you should do a ldap query based on the incoming MAC address: > > user { > filter = "(userServices=%{User-Name})" > > Assuming the User-Name is the MAC address of the incoming client. The > "userServices" I assume is the multi-valued attribute in your ldap > directory. > > I have tried this, but it checking for the first value only and accepting only for the first filed value out of three.
> Then if you get a response you know the record exists, otherwise it doesn't > and reject the request. > > > > On Wed, Sep 13, 2017 at 4:36 AM, Steffen Klemer < steffen.klemer@gwdg.de> > wrote: > > > Am Di, 12.09.2017 um 18:30 schrieb Srinivasa R > > <srinivasa.r@icts.res.in>: > > > > > I have installed FreeRADIUS server (Version 3.0.4) on Cent 7 OS and > > > configured the external authentication with 389-DS server using > > > rlm_ldap module. I would like to authenticate the mac address of all > > > the user which I have stored in LDAP. The macaddress field in LDAP is > > > a multi value attribute and the Freeraiud is communicating with LDAP > > > without any issues, but the freeradius is authenticating only the > > > first macaddress value from LDAP's multi value field. > > > > > > I would like to configure the Freeradius to authenticate all the > > > values from multi value filed. Someone suggested that we can > > > configure this using rlm_python or rlm_perl module. I am not a coder > > > and I am not able to find any step by guide to configure the same. > > > Could someone guide me on how to configure the Freeradius to > > > authenticate Multi-valued LDAP attribute? > > > > I used unlang features to implement sth. like this. I think you can > > adapt it to your use case. > > > > > > In the LDAP module I have sth like > > > > update { > > request:gwdg-user-services += 'userServices' > > } > > > > where userServices is multi-valued and sometimes included > > 'eduroamNotAllowed' > > > > > > In the site I check against all occurrences: > > > > if ( &gwdg-user-services[*] !~ /eduroamNotAllowed/ ) { > > ... > > } > > > > > > lg > > /Steffen > > > > -- > > Steffen Klemer E-Mail: Steffen.Klemer@gwdg.de > > Tel: +49 551 201 2170 > > > > ------------------------------------------------------------------ > > GWDG - Gesellschaft für wissenschaftliche > > Datenverarbeitung mbH Göttingen > > Am Faßberg 11, 37077 Göttingen > > > > Service-Hotline: > > Tel: +49 551 201-1523 > > E-Mail: support@gwdg.de > > > > Kontakt: > > Tel: 0551 201-1510 > > Fax: 0551 201-2150 > > E-Mail: gwdg@gwdg.de > > WWW: https://www.gwdg.de > > ------------------------------------------------------------------ > > Geschäftsführer: Prof. Dr. Ramin Yahyapour > > Aufsichtsratsvorsitzender: Prof. Dr. Christian Griesinger > > Sitz der Gesellschaft: Göttingen > > Registergericht: Göttingen, Handelsregister-Nr. B 598 > > ------------------------------------------------------------------ > > Zertifiziert nach ISO 9001 > > ------------------------------------------------------------------ > > > > - > > List info/subscribe/unsubscribe? See http://www.freeradius.org/ > > list/users.html > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/ > list/users.html >
Regards, --
Srinivas R - List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html
Information in this email including any attachments may be privileged, confidential and is intended exclusively for the addressee. The views expressed may not be official policy, but the personal views of the originator. If you have received it in error, please notify the sender by return e-mail and delete it from your system. You should not reproduce, distribute, store, retransmit, use or disclose its contents to anyone. Please note we reserve the right to monitor all e-mail communication through our internal and external networks. SKY and the SKY marks are trademarks of Sky plc and Sky International AG and are used under licence.
Sky UK Limited (Registration No. 2906991), Sky-In-Home Service Limited (Registration No. 2067075) and Sky Subscribers Services Limited (Registration No. 2340150) are direct or indirect subsidiaries of Sky plc (Registration No. 2247735). All of the companies mentioned in this paragraph are incorporated in England and Wales and share the same registered office at Grant Way, Isleworth, Middlesex TW7 5QD.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html
-- Srinivas R Scientific Officer 'C' International Centre for Theoretical Sciences (ICTS) Survey No. 151, Shivakote, Hesaraghatta Hobli, Bengaluru North - 560 089, India. Office: 080 - 6730/4653-6305 | Mob: +91 9886280088 Email: srinivasa.r@icts.res.in Website: www.icts.res.in