Multiple LDAP searches
I am setting up freeradius 2.1.6 and seem to be stuck on how do I go about setting up my ldap module to search multiple basedn if the user is not found in the first? I have four that I need to search in my LDAP tree but cannot figure out the correct way to make it search more than one. I feel like this is probably something simple I'm missing but can't seem to see it atm. Thanks Rob
Rob Brickhouse wrote:
I am setting up freeradius 2.1.6 and seem to be stuck on how do I go about setting up my ldap module to search multiple basedn if the user is not found in the first? I have four that I need to search in my LDAP tree but cannot figure out the correct way to make it search more than one. I feel like this is probably something simple I'm missing but can't seem to see it atm.
There's no simple way to do that. The intent of the LDAP module is to have *one* set of users. Instead, you want fail-over for LDAP searches: search BASEDN A, and stop if the user is found otherwise, search BASEDN B, and stop if the user is found otherwise.... That's complicated. I suggest looking to see if your LDAP server can provide a "view" that is the union of the 4 basedns. Otherwise, maybe write a Perl script, or simply configure 4 copies of the LDAP module, and then do the fail-over config in FreeRADIUS. Alan DeKok.
I am setting up freeradius 2.1.6 and seem to be stuck on how do I go about setting up my ldap module to search multiple basedn if the user >is not found in the first? I have four that I need to search in my LDAP tree but cannot figure out the correct way to make it search more >than one. I feel like this is probably something simple I'm missing but can't seem to see it atm.
Hi, I have two instances defined in modules/ldap ldap ldap_staff { ............... basedn = "ou=staff, ..............." .............. } ldap ldap_student { ............... basedn = "ou=student, ..............." .............. } Then, in authorise section, ldap_staff if (ok) { whatever stuff you need } else { ldap_student if (ok) { whatever other stuff you need } else { reject } } # In my case the "stuff" returns cisco av pairs to control the switches. The usert is rejected if they don't exist in either the "staff" or the "student" ou. Hope this helps, Leighton ________________________________ --- This transmission is confidential and may be legally privileged. If you receive it in error, please notify us immediately by e-mail and remove it from your system. If the content of this e-mail does not relate to the business of the University of Huddersfield, then we do not endorse it and will accept no liability.
participants (3)
-
Alan DeKok -
Leighton Man -
Rob Brickhouse