In auth-post of deafult file right or inner-tunnel?

Sent from my iPhone

> On Oct 30, 2017, at 3:15 AM, Lasse Odden <lasse.odden@gmail.com> wrote:
> 
> Try to use;
> 
> reply:class := "Name_of_VPNgroup_in_ASA"
> 
> 
> In examle:
> if (LDAP-Group == "SSL-VPN-Visma-web") {
>        update  {
>                reply:Class := "Visma-web_Grp"
>        }
> }
> else {
>        update  {
>                reply:Class := "NoAccess"
> }
> 
> regards,
> Lasse
> 
>> On Mon, Oct 30, 2017 at 6:00 AM, Satish Patel <satish.txt@gmail.com> wrote:
>> 
>> I am configuring freeradius for Cisco ASA VPN and i have create
>> multiple Group Policy on ASA now i want to send those group name back
>> to NAS using Class Attributes #25  as per following document (they are
>> using Windows IAS)
>> 
>> http://www.dasblinkenlichten.com/using-radius-attributes-
>> during-webvpn-logon/
>> 
>> Same setup i want to do in Linux Freeradius so where should i definite
>> that attribute? Should i use that in /etc/raddb/user  or
>> /etc/raddb/sites-enabled/default  file in post-auth section?  I did
>> following and i am getting following result but not sure i am doing it
>> right or not
>> 
>> post-auth {
>> update reply {
>>                Class := OU=Group_VPN;
>>        }
>> }
>> 
>> 
>> 
>> Sent Access-Request Id 40 from 0.0.0.0:35534 to 127.0.0.1:1812 length 76
>> User-Name = "user1"
>> User-Password = "password1"
>> NAS-IP-Address = 10.5.3.31
>> NAS-Port = 1812
>> Message-Authenticator = 0x00
>> Cleartext-Password = "password1"
>> Received Access-Accept Id 40 from 127.0.0.1:1812 to 0.0.0.0:0 length 35
>> Class = 0x4f553d47726f75705f56504e3b
>> -
>> List info/subscribe/unsubscribe? See http://www.freeradius.org/
>> list/users.html
> -
> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Remember that for EAP methods such as PEAP and TTLS, you cannot trust the outer username so policies should be defined in inner-tunnel (where username is known) with relevant copying to the outer reply alan On 31 Oct 2017 5:39 am, "Muenz, Michael" <m.muenz@spam-fetish.org> wrote:

Am 30.10.2017 um 13:33 schrieb Satish Patel:

...

In auth-post of deafult file right or inner-tunnel?

Hi,

post-auth section in default. You can do quite complex setup with this:

if (User-Name =~ /^m[0-9][0-9][0-9]_/) { update reply { Class := "groupX" } } elsif (User-Name =~ /^admin_/) { update reply { Class := "groupAdmins" } } elsif (User-Name =~ /^service_/) { update reply { Class := "groupService" } } else { update reply { Class := "groupDefault" } }

Michael

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list /users.html

On Oct 31, 2017, at 10:55 AM, Satish Patel <satish.txt@gmail.com> wrote:

I am getting this error

...

Tue Oct 31 10:52:38 2017 : Error: /etc/raddb/sites-enabled/default[734]: Invalid location for 'else'. There is no preceding 'if' statement

Then fix your configuration so it's correct. The text you posted here is NOT what you have in the configuration files. Alan DeKok

On Oct 31, 2017, at 11:27 AM, Satish Patel <satish.txt@gmail.com> wrote:

I am new to unlang and having hard time to correct that if else, everything seems good but don't know why throwing error. I have copy paste "Lasse Odden" example from earlier post.

Perhaps you could try typing in a simple "if / else" and seeing if that works. It will. So the error is in the text you copied and pasted. The problem here is that you should be able to do basic debugging yourself. There's no magic in entering text into configuration files. Alan DeKok.

I have tried every single combination that is what i am trying to say don't, what do you think about following? if (LDAP-Group == "Group_VPN" ) { update reply { Class := Group_VPN; } else { update reply { reply:Class := "NoAccess" } } } On Tue, Oct 31, 2017 at 11:44 AM, Muenz, Michael <m.muenz@spam-fetish.org> wrote:

Am 31.10.2017 um 15:55 schrieb Satish Patel:

...

I am getting this error

if (LDAP-Group == "Group_VPN") { update { reply:Class := "OU=Group_VPN" } } else { update { reply:Class := "NoAccess" }

There's a missing clsing bracket or your posted config is incomplete. No way to help with this information.

Michael

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Fixed it! it is different than what i thought if else...! people here to help anyway thanks all of you. On Tue, Oct 31, 2017 at 11:58 AM, Alan DeKok <aland@deployingradius.com> wrote:

...

On Oct 31, 2017, at 11:50 AM, Satish Patel <satish.txt@gmail.com> wrote:

I have tried every single combination that is what i am trying to say don't, what do you think about following?

It doesn't matter what we think.

What matters is your configuration is broken, and you're trying to reformat it. You SHOULD be trying to fix it.

Delete all of the broken text and re-enter it by hand. Start with just the "if" statement. Test the server. Add more text. Test the server again.

Honestly, if you can't edit configuration files && debug them, I have to wonder why you're doing IT administration.

Alan DeKok.

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html