On Jul 4, 2016, at 9:26 AM, Adamczak Krzysztof <kradamcz@gmail.com> wrote:

Thanks for your help. Actually I can do ldapsearch that return that profile. I cannot modify ldap structure. It seems that I need to set eg. profile default dynamically. Can I put profile name taken from ldap user account and set it in profile/default ldap module property?

Yes.

Something like this:

profile { default = "uid=%{profile_attribute_value_from_ldap_user_account},ou=profiles,dc=example,dc=com" }

You'll need to get that attribute somehow. Typically via an LDAP query. update control { My-LDAP-Profile := "%{ldap:...}" } Be sure to list that *before* the call to the "ldap" module. And also define My-LDAP-Profile as "string" in raddb/dictionary The just use %{My-LDAP-Profie} in the ldap configuration. The only danger is that if the returned profile has "magic" characters, the LDAP module may escape them. In that case, it will be a bit more work to figure out a solution. The larger answer is that your use-case is pretty unusual. Alan DeKok.

On Tue, Jul 5, 2016 at 2:54 AM, Adamczak Krzysztof <kradamcz@gmail.com> wrote:

Thanks Alan I appreciate your help. I'll give it a try. Probably tomorrow I'll check if it'll work :)

If you look at how the profile value is documented in 3.0.x I have made it work by making two LDAP calls, one to first retrieve the LDAP value, then to call it again to apply the profile. As the profile needs to be a DN not a CN attribute. In my ldap module I specify the request:User-Profile gets updated with the value we want to use. update { .... request:User-Profile := 'description' } And the profile mapping the default value to the &control:User-Profile profile { filter = '(objectclass=groupOfNames)' default = &control:User-Profile } So under the authorize section: update control { User-Profile = "cn=null" } ldap if ( request:User-Profile ) { update control { User-Profile := "uid=%{request:User-Profile},ou=profiles,dc=example,dc=com" } ldap } That way the first time you call the LDAP module the User-Profile doesn't match to anything, then if you get a request:User-Profile added by the ldap module you call it again with the updated control:User-Profile Then in your trace you would see something like: (0) ldap: EXPAND (cn=%{%{Stripped-User-Name}:-%{User-Name}}) (0) ldap: --> (cn=peter) (0) ldap: Performing search in "o=identities" with filter "(cn=peter)", scope "sub" (0) ldap: Waiting for search result... (0) ldap: User object found at DN "cn=Peter,o=Identities" (0) ldap: Performing search in "cn=null" with filter "(objectclass=groupOfNames)", scope "base" 0) ldap: Waiting for search result... (0) ldap: The specified DN wasn't found (0) ldap: Search returned no results (0) ldap: Profile object "cn=null" not found (0) ldap: Processing user attributes (0) ldap: request:User-Profile := 'dns1' rlm_ldap (ldap): Released connection (0) rlm_ldap (ldap): Need 5 more connections to reach 10 spares rlm_ldap (ldap): Opening additional connection (5), 1 of 27 pending slots used rlm_ldap (ldap): Connecting to ldap://localhost:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (0) [ldap] = updated (0) if ( request:User-Profile ) { (0) if ( request:User-Profile ) -> TRUE (0) if ( request:User-Profile ) { (0) update control { (0) EXPAND cn=%{request:User-Profile},ou=Profiles,o=Identities (0) --> cn=dns1,ou=Profiles,o=Identities (0) User-Profile := cn=dns1,ou=Profiles,o=Identities (0) } # update control = noop rlm_ldap (ldap): Reserved connection (1) (0) ldap: EXPAND (cn=%{%{Stripped-User-Name}:-%{User-Name}}) (0) ldap: --> (cn=peter) (0) ldap: Performing search in "o=identities" with filter "(cn=peter)", scope "sub" (0) ldap: Waiting for search result... (0) ldap: User object found at DN "cn=Peter,o=Identities" (0) ldap: Performing search in "cn=dns1,ou=Profiles,o=Identities" with filter "(objectclass=groupOfNames)", scope "base" (0) ldap: Waiting for search result... (0) ldap: Processing profile attributes (0) ldap: reply:MSG1 := '5.43.4.2' (0) ldap: Processing user attributes (0) ldap: request:User-Profile := 'dns1' (0) ldap: reply:Framed-IP-Address := 4.2.3.2 rlm_ldap (ldap): Released connection (1) Works for me.

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

mods-enabled/ldap (without filter and &syntax wasn't evaluated so I changed it to % (BBTW any idea why?)):

The & operator is newish (it was introduced somewhere in 3.0.x). It doesn't work in older configurations. Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp@jabber.dev.ja.net skype: stefan.paetow.janet jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.