Hi! I want to add the LDAP-users current groups as extra attributes to the authentication reply. Is it possible? I'm having a hard time finding documentation about this. Thanks! Robin
On 13/03/13 14:44, Robin Helgelin wrote:
Hi!
I want to add the LDAP-users current groups as extra attributes to the authentication reply.
Is it possible? I'm having a hard time finding documentation about this.
Yes. Edit the ldap.attrmap to map the LDAP group attribute to a RADIUS attribute, and add the RADIUS attribute to raddb/dictionary (taking care to note the comments about numbering i.e. pick a number from 3000-3999). Don't re-use an existing attribute - many of the xxGroup attribute have "magic" behaviour hooks.
On 13 Mar 2013, at 10:52, Phil Mayers <p.mayers@imperial.ac.uk> wrote:
On 13/03/13 14:44, Robin Helgelin wrote:
Hi!
I want to add the LDAP-users current groups as extra attributes to the authentication reply.
Is it possible? I'm having a hard time finding documentation about this.
Yes. Edit the ldap.attrmap to map the LDAP group attribute to a RADIUS attribute, and add the RADIUS attribute to raddb/dictionary (taking care to note the comments about numbering i.e. pick a number from 3000-3999). Don't re-use an existing attribute - many of the xxGroup attribute have "magic" behaviour hooks.
Phili is correct, but this will only work for something like AD, where you have memberOf attributes which link a user account to a group. This also doesn't really work if you want a group name, and the membership attributes specify a group DN, though it'd probably be pretty easy to figure out the group name later (you could even do it within unlang if you're using FR 3.0). Where you have the inverse, i.e. a group object specifying user names or user DNs the code doesn't currently support group retrieval, feel free to submit patches. -Arran
On Wed, Mar 13, 2013 at 4:11 PM, Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:
Yes. Edit the ldap.attrmap to map the LDAP group attribute to a RADIUS attribute, and add the RADIUS attribute to raddb/dictionary (taking care to note the comments about numbering i.e. pick a number from 3000-3999). Don't re-use an existing attribute - many of the xxGroup attribute have "magic" behaviour hooks.
Phili is correct, but this will only work for something like AD, where you have memberOf attributes which link a user account to a group.
This also doesn't really work if you want a group name, and the membership attributes specify a group DN, though it'd probably be pretty easy to figure out the group name later (you could even do it within unlang if you're using FR 3.0).
Thanks, we're using the memberof overlay, and that might be working. First problem is that I need to rewrite the output from ldap to something the radius-client finds useful. But there are radius modules for rewriting things right? Next problem seems to be that freeradius ignores when ldap is returning more than one group, am I correct? -- regards, Robin
On 13 Mar 2013, at 15:45, Robin Helgelin <lobbin@gmail.com> wrote:
On Wed, Mar 13, 2013 at 4:11 PM, Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:
Yes. Edit the ldap.attrmap to map the LDAP group attribute to a RADIUS attribute, and add the RADIUS attribute to raddb/dictionary (taking care to note the comments about numbering i.e. pick a number from 3000-3999). Don't re-use an existing attribute - many of the xxGroup attribute have "magic" behaviour hooks.
Phili is correct, but this will only work for something like AD, where you have memberOf attributes which link a user account to a group.
This also doesn't really work if you want a group name, and the membership attributes specify a group DN, though it'd probably be pretty easy to figure out the group name later (you could even do it within unlang if you're using FR 3.0).
Thanks, we're using the memberof overlay, and that might be working.
First problem is that I need to rewrite the output from ldap to something the radius-client finds useful. But there are radius modules for rewriting things right?
Um, yes, but you can probably just use unlang.
Next problem seems to be that freeradius ignores when ldap is returning more than one group, am I correct?
Ignores what? If you're talking about an xlat query, then yes, it'll only provide the first result. -Arran
On 13 mar 2013, at 20:52, Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:
Next problem seems to be that freeradius ignores when ldap is returning more than one group, am I correct?
Ignores what?
If you're talking about an xlat query, then yes, it'll only provide the first result.
Yes, and there are no workarounds to that? More than editing the code I guess :) Would it be possible to another post-auth module to do this instead? As the ldap module itself seems not quite what I'm trying to do here. Regards, Robin
On 13 Mar 2013, at 16:17, Robin Helgelin <lobbin@gmail.com> wrote:
On 13 mar 2013, at 20:52, Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:
Next problem seems to be that freeradius ignores when ldap is returning more than one group, am I correct?
Ignores what?
If you're talking about an xlat query, then yes, it'll only provide the first result.
Yes, and there are no workarounds to that? More than editing the code I guess :)
No. xlat is just string expansion (replacing placeholders in the string with other values). There are cases where it's used (abused) to do other things, but normally it only produces one value, the expanded string.
Would it be possible to another post-auth module to do this instead? As the ldap module itself seems not quite what I'm trying to do here.
You could use one of the dynamic language modules, python, perl, ruby etc. Usually people just need to verify a user is in a certain group, they don't usually need to return all the groups a user is in... -Arran
On 03/13/2013 07:45 PM, Robin Helgelin wrote:
First problem is that I need to rewrite the output from ldap to something the radius-client finds useful. But there are radius modules for rewriting things right?
Yes, though TBH manipulating LDAP DNs in unlang/attr_rewrite is going to be a pain. You might have to fall back on one of the scripting language modules, as Arran says.
Next problem seems to be that freeradius ignores when ldap is returning more than one group, am I correct?
If you mean that you've setup ldap.attrmap but are only seeing one group, you might need to use the "operator" column and set it to +=
On 14 mar 2013, at 11:06, Phil Mayers <p.mayers@imperial.ac.uk> wrote:
On 03/13/2013 07:45 PM, Robin Helgelin wrote:
First problem is that I need to rewrite the output from ldap to something the radius-client finds useful. But there are radius modules for rewriting things right?
Yes, though TBH manipulating LDAP DNs in unlang/attr_rewrite is going to be a pain. You might have to fall back on one of the scripting language modules, as Arran says.
Yes, I ended up writing a small python script, works very nicely :) The only thing missing is if it's possible for the ldap module to set an attribute with the users full dn to be available for the python module. Regards, Robin
On 14 Mar 2013, at 13:39, Robin Helgelin <lobbin@gmail.com> wrote:
On 14 mar 2013, at 11:06, Phil Mayers <p.mayers@imperial.ac.uk> wrote:
On 03/13/2013 07:45 PM, Robin Helgelin wrote:
First problem is that I need to rewrite the output from ldap to something the radius-client finds useful. But there are radius modules for rewriting things right?
Yes, though TBH manipulating LDAP DNs in unlang/attr_rewrite is going to be a pain. You might have to fall back on one of the scripting language modules, as Arran says.
Yes, I ended up writing a small python script, works very nicely :)
The only thing missing is if it's possible for the ldap module to set an attribute with the users full dn to be available for the python module.
That'd be the LDAP-UserDN attribute... -Arran
On 14 mar 2013, at 18:44, Arran Cudbard-Bell wrote:
That'd be the LDAP-UserDN attribute…
I know, but that attribute isn't presented to the python function call. Is there another way such as an environmental variable or just "please update the source"? :) regards, Robin
On 15 Mar 2013, at 08:43, Robin Helgelin <lobbin@gmail.com> wrote:
On 14 mar 2013, at 18:44, Arran Cudbard-Bell wrote:
That'd be the LDAP-UserDN attribute…
I know, but that attribute isn't presented to the python function call. Is there another way such as an environmental variable or just "please update the source"? :)
Did you check the control list (config item tuple)? -Arran
On Fri, Mar 15, 2013 at 2:03 PM, Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:
I know, but that attribute isn't presented to the python function call. Is there another way such as an environmental variable or just "please update the source"? :)
Did you check the control list (config item tuple)?
As far as I can tell, the module only provides the request packet, request->packet->vps It does however update the config if provided from the module function. -- regards, Robin
participants (3)
-
Arran Cudbard-Bell -
Phil Mayers -
Robin Helgelin