Hello, All When trying to build a dynamic VLAN, the contact point of ldap differs depending on AP, Can I control which LDAP attribute to map per ldap query? And what should I offer to receive advice? Any help would be appreciated.
On Jul 16, 2019, at 3:54 AM, Yuya Yanagi <peacefull64@gmail.com> wrote:
When trying to build a dynamic VLAN, the contact point of ldap differs depending on AP,
What does that mean?
Can I control which LDAP attribute to map per ldap query?
And what should I offer to receive advice?
Any help would be appreciated.
See mods-available/ldap The module documents what it does, and how it works. Please ask *specific* questions about that functionality. Alan DeKok.
Hi, Alan I was sorry for asking vague questions. There is a request to return the Vlan-id only when connecting to a specific AP at the customer's request, and we are struggling to solve the problem. I'll show you the mods-available/ldap file. I've included mapping file in the update section below, but I want to include additional mapping file for specific AP.(Location of the arrow mark) But if you include an if statement, you will get an error [Invalid location for 'if']. Is there a good way to make it happen? ----------------- ldap ldap_vipusers { server = "ldaps://ldap.hoge.fuga.co.jp:636" identity = "uid=radius,ou=systems,dc=hoge,dc=fuga,dc=co,dc=jp" password = "password" user{ base_dn = "ou=Users,dc=hoge,dc=fuga,dc=co,dc=jp" filter = "(&(!(fugaPersoncocountStatus=03))(!(fugaPersoncocountStatus=04))(uid=%{%{Stripped-User-Name}:-%{User-Name}}))" } tls { start_tls = no ca_file = /etc/raddb/certs/ldap.hoge.fuga.co.jp.cer } update { $INCLUDE ${confdir}/mods-available/ldap.attrmap → ※【I want to include an attribute file only for specific AP connections】 if ("&Called-Station-id" =: "vipWifi") { $INCLUDE ${confdir}/mods-available/ldap.vlan.attrmap } } options { res_timeout = 10 srv_timelimit = 3 net_timeout = 1 idle = 60 probes = 3 interval = 3 } pool { start = 5 min = 3 max = 32 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 30 spread = no } } 2019年7月17日(水) 1:37 Alan DeKok <aland@deployingradius.com>:
On Jul 16, 2019, at 3:54 AM, Yuya Yanagi <peacefull64@gmail.com> wrote:
When trying to build a dynamic VLAN, the contact point of ldap differs depending on AP,
What does that mean?
Can I control which LDAP attribute to map per ldap query?
And what should I offer to receive advice?
Any help would be appreciated.
See mods-available/ldap
The module documents what it does, and how it works. Please ask *specific* questions about that functionality.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Jul 17, 2019, at 2:44 AM, Yuya Yanagi <peacefull64@gmail.com> wrote:
There is a request to return the Vlan-id only when connecting to a specific AP at the customer's request, and we are struggling to solve the problem.
You can do dynamic LDAP queries: authorize { ... if (specific AP) { update reply { Tunnel-Private-Group-Id := "%{ldap:... LDAP QUERY ....}" } }
I'll show you the mods-available/ldap file. I've included mapping file in the update section below, but I want to include additional mapping file for specific AP.(Location of the arrow mark) But if you include an if statement, you will get an error [Invalid location for 'if'].
Yes, because the "if" condition isn't allowed there. Alan DeKok.
Hi,Alan Thank you for the advice! I'm trying to do it with Dynamic LDAP, which I was taught, but I'd like you to tell me because it doesn't work well. I've written a sample of dynamic LDAP, and it is a part of [ if (specific AP) { ], but I want to extract the SSID name in the value of Called-Station-Id, but I'm having trouble not extracting it well. I tried to make the if statement look like this, but the result is No Matches and the IF statement becomes FALSE. Can you give me advice on how to extract only the SSID from the Called-Station-Id and branch it? This is the set IF statement. if (&Called-Station-Id =~ /.*:authtest$/ ) { ........ } ※authtest is the SSID name that you want to determine ------------Debuglog------------------ Thu Jul 18 12:06:28 2019 : Debug: (5) } # update control = noop Thu Jul 18 12:06:28 2019 : Debug: (5) if (%Called-Station-Id =~ /.*:authtest$/ ) { Thu Jul 18 12:06:28 2019 : Debug: No matches Thu Jul 18 12:06:28 2019 : Debug: (5) if (%Called-Station-Id =~ /.*:authtest$/ ) -> FALSE Thu Jul 18 12:06:28 2019 : Debug: (5) else { 2019年7月17日(水) 19:32 Alan DeKok <aland@deployingradius.com>:
On Jul 17, 2019, at 2:44 AM, Yuya Yanagi <peacefull64@gmail.com> wrote:
There is a request to return the Vlan-id only when connecting to a specific AP at the customer's request, and we are struggling to solve the problem.
You can do dynamic LDAP queries:
authorize { ... if (specific AP) { update reply { Tunnel-Private-Group-Id := "%{ldap:... LDAP QUERY ....}" } }
I'll show you the mods-available/ldap file. I've included mapping file in the update section below, but I want to include additional mapping file for specific AP.(Location of the arrow mark) But if you include an if statement, you will get an error [Invalid location for 'if'].
Yes, because the "if" condition isn't allowed there.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi,Alan. There are things that I want to confirm in addition. update reply { Tunnel-Private-Group-Id: = "% {ldap: ... LDAP QUERY ....}" } I was asked to propose a method of dynamic LDAP, but I am still validating, but there is no sign that can be found in the log, and I am having trouble understanding the status. When I do this process, is the value of VLANID substituted for Tunnel-Private-Group-Id in the log? 2019-07-17 19:32 GMT+09:00, Alan DeKok <aland@deployingradius.com>:
On Jul 17, 2019, at 2:44 AM, Yuya Yanagi <peacefull64@gmail.com> wrote:
There is a request to return the Vlan-id only when connecting to a specific AP at the customer's request, and we are struggling to solve the problem.
You can do dynamic LDAP queries:
authorize { ... if (specific AP) { update reply { Tunnel-Private-Group-Id := "%{ldap:... LDAP QUERY ....}" } }
I'll show you the mods-available/ldap file. I've included mapping file in the update section below, but I want to include additional mapping file for specific AP.(Location of the arrow mark) But if you include an if statement, you will get an error [Invalid location for 'if'].
Yes, because the "if" condition isn't allowed there.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
n Jul 18, 2019, at 1:48 AM, Yuya Yanagi <peacefull64@gmail.com> wrote:
I was asked to propose a method of dynamic LDAP, but I am still validating, but there is no sign that can be found in the log, and I am having trouble understanding the status.
I don't know what that means. Read the debug output. If you don't understand it, post it here.
When I do this process, is the value of VLANID substituted for Tunnel-Private-Group-Id in the log?
I have no idea what that means. Alan DeKok.
Hello. I want to get vlanId (radiusTunnelPrivateGroupId) of the user I want to authenticate. Ldap query How should I write?
You can do dynamic LDAP queries:
authorize { ... if (specific AP) { update reply { Tunnel-Private-Group-Id := "{ldap:ldap:///ou=Users,dc=edu,dc=com,uid?sub?radiusTunnelPrivateGroupId?}" } } → Failed parsing expanded string Is there a description method? Can I get vlan registered in ldap with any uid? Thanks nn
-----Original Message----- From: Freeradius-Users <freeradius-users-bounces+nobuatsu.nishimura.dg=ps.hitachi-solutions.com@lists.freeradius.org> On Behalf Of Alan DeKok Sent: Wednesday, July 17, 2019 7:33 PM To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: [!]Re: I want to branch an ldap attribute On Jul 17, 2019, at 2:44 AM, Yuya Yanagi <peacefull64@gmail.com> wrote:
There is a request to return the Vlan-id only when connecting to a specific AP at the customer's request, and we are struggling to solve the problem.
You can do dynamic LDAP queries: authorize { ... if (specific AP) { update reply { Tunnel-Private-Group-Id := "%{ldap:... LDAP QUERY ....}" } }
I'll show you the mods-available/ldap file. I've included mapping file in the update section below, but I want to include additional mapping file for specific AP.(Location of the arrow mark) But if you include an if statement, you will get an error [Invalid location for 'if'].
Yes, because the "if" condition isn't allowed there. Alan DeKok. - List info/subscribe/unsubscribe? See https://clicktime.symantec.com/3EofmZr5EVDowDheUVUbpYU7Vc?u=http%3A%2F%2Fwww...
On Jul 18, 2019, at 10:33 PM, 西村暢敦 / NISHIMURA，NOBUATSU <nobuatsu.nishimura.dg@ps.hitachi-solutions.com> wrote:.
I want to get vlanId (radiusTunnelPrivateGroupId) of the user I want to authenticate. Ldap query How should I write?
See LDAP documentation for how to write LDAP queries. Then, paste the query into the FreeRADIUS configuration.
You can do dynamic LDAP queries:
authorize { ... if (specific AP) { update reply { Tunnel-Private-Group-Id := "{ldap:ldap:///ou=Users,dc=edu,dc=com,uid?sub?radiusTunnelPrivateGroupId?}"
That isn't correct. The expansion uses %{...}.
} }
→ Failed parsing expanded string
Post the debug output. There is just *no* reason for failing to do this.
Is there a description method?
There's lots of documentation for both FreeRADIUS and for LDAP.
Can I get vlan registered in ldap with any uid?
That's a question for LDAP, not FreeRADIUS. Alan DeKok.
Thanks Alan for the quick response! The configuration has been corrected. authorize { ... if (specific AP) { update reply { Tunnel-Private-Group-Id := %{ldap:ldap:///ou=Users,dc=edu,dc=kkc,dc=imc,dc=com?uid?sub?uid=%u(radiusTunnelPrivateGroupId)} } } It will be an error. Do you understand the cause? Please tell me the solution. Below is my debug output Mon Jul 22 14:07:39 2019 : Debug: radiusd: #### Loading Virtual Servers #### Mon Jul 22 14:07:39 2019 : Debug: server { # from file /etc/raddb/radiusd.conf Mon Jul 22 14:07:39 2019 : Debug: } # server Mon Jul 22 14:07:39 2019 : Debug: server default { # from file /etc/raddb/sites-enabled/default Mon Jul 22 14:07:39 2019 : Debug: authenticate { Mon Jul 22 14:07:39 2019 : Debug: group { Mon Jul 22 14:07:39 2019 : Debug: mschap Mon Jul 22 14:07:39 2019 : Debug: } Mon Jul 22 14:07:39 2019 : Debug: mschap Mon Jul 22 14:07:39 2019 : Debug: group { Mon Jul 22 14:07:39 2019 : Debug: if (&Realm == "edu.com" || &Realm == "edu.imc.com" || &Realm == "kkc.com") { Mon Jul 22 14:07:39 2019 : Debug: ldap_generalusers Mon Jul 22 14:07:39 2019 : Debug: } Mon Jul 22 14:07:39 2019 : Debug: elsif (&Realm == "NULL") { Mon Jul 22 14:07:39 2019 : Debug: if (&NAS-IP-Address == 10.254.x.xxx && &Framed-IP-Address =~ /^10\.241(\.[0-9]{1,3}){2}$/) { Mon Jul 22 14:07:39 2019 : Debug: ldap_outside Mon Jul 22 14:07:39 2019 : Debug: } Mon Jul 22 14:07:39 2019 : Debug: else { Mon Jul 22 14:07:39 2019 : Debug: ldap_allstudent Mon Jul 22 14:07:39 2019 : Debug: } Mon Jul 22 14:07:39 2019 : Debug: } Mon Jul 22 14:07:39 2019 : Debug: } Mon Jul 22 14:07:39 2019 : Debug: eap Mon Jul 22 14:07:39 2019 : Debug: } # authenticate Mon Jul 22 14:07:39 2019 : Debug: authorize { Mon Jul 22 14:07:39 2019 : Debug: policy rewrite_called_station_id { Mon Jul 22 14:07:39 2019 : Debug: if (&Called-Station-Id && &Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})([^0-9a-f](.+))?$/) { Mon Jul 22 14:07:39 2019 : Debug: update { Mon Jul 22 14:07:39 2019 : Debug: &Called-Station-Id := "%{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}}" Mon Jul 22 14:07:39 2019 : Debug: } Mon Jul 22 14:07:39 2019 : Debug: if ("%{8}") { Mon Jul 22 14:07:39 2019 : Debug: update { Mon Jul 22 14:07:39 2019 : Debug: &Called-Station-SSID := "%{8}" Mon Jul 22 14:07:39 2019 : Debug: } Mon Jul 22 14:07:39 2019 : Debug: } Mon Jul 22 14:07:39 2019 : Debug: updated Mon Jul 22 14:07:39 2019 : Debug: } Mon Jul 22 14:07:39 2019 : Debug: else { Mon Jul 22 14:07:39 2019 : Debug: noop Mon Jul 22 14:07:39 2019 : Debug: } Mon Jul 22 14:07:39 2019 : Debug: } Mon Jul 22 14:07:39 2019 : Debug: preprocess Mon Jul 22 14:07:39 2019 : Debug: mschap Mon Jul 22 14:07:39 2019 : Debug: digest Mon Jul 22 14:07:39 2019 : Debug: suffix Mon Jul 22 14:07:39 2019 : Debug: eap Mon Jul 22 14:07:39 2019 : Debug: if { Mon Jul 22 14:07:39 2019 : Debug: ldap_allstudents Mon Jul 22 14:07:39 2019 : Debug: update { Mon Jul 22 14:07:39 2019 : Debug: &control:Auth-Type := LDAP Mon Jul 22 14:07:39 2019 : Debug: } Mon Jul 22 14:07:39 2019 : Debug: update { Mon Jul 22 14:07:39 2019 : Debug: &reply:Tunnel-Private-Group-Id := %{ldap:ldap:///ou=Users Mon Jul 22 14:07:39 2019 : Debug: &reply:dc = edu Mon Jul 22 14:07:39 2019 : Debug: &reply:dc = kkc Mon Jul 22 14:07:39 2019 : Debug: &reply:dc = imc Mon Jul 22 14:07:39 2019 : Debug: &reply:dc = Mon Jul 22 14:07:39 2019 : Debug: } Mon Jul 22 14:07:39 2019 : Debug: } Mon Jul 22 14:07:39 2019 : Debug: } Mon Jul 22 14:07:39 2019 : Debug: } Mon Jul 22 14:07:39 2019 : Debug: expiration Mon Jul 22 14:07:39 2019 : Debug: logintime Mon Jul 22 14:07:39 2019 : Debug: } # authorize Mon Jul 22 14:07:39 2019 : Debug: preacct { Mon Jul 22 14:07:39 2019 : Debug: preprocess ..... Mon Jul 22 14:07:39 2019 : Debug: if (&outer.request:Called-Station-SSID == 'authtest') { Mon Jul 22 14:07:39 2019 : Debug: update { Mon Jul 22 14:07:39 2019 : Debug: &control:Auth-Type := LDAP Mon Jul 22 14:07:39 2019 : Debug: } Mon Jul 22 14:07:39 2019 : Debug: update { Mon Jul 22 14:07:39 2019 : Debug: &reply:Tunnel-Private-Group-Id := %{ldap:ldap:///ou=Users Mon Jul 22 14:07:39 2019 : Debug: &reply:dc = edu Mon Jul 22 14:07:39 2019 : Debug: &reply:dc = kkc Mon Jul 22 14:07:39 2019 : Debug: &reply:dc = imc Mon Jul 22 14:07:39 2019 : Debug: &reply:dc = Mon Jul 22 14:07:39 2019 : Debug: } Mon Jul 22 14:07:39 2019 : Debug: } Mon Jul 22 14:07:39 2019 : Debug: updated Mon Jul 22 14:07:39 2019 : Debug: } Mon Jul 22 14:07:39 2019 : Debug: } Mon Jul 22 14:07:39 2019 : Error: /etc/raddb/sites-enabled/default[463]: Unknown attribute 'dc' Regards n.n -----Original Message----- From: Freeradius-Users <freeradius-users-bounces+nobuatsu.nishimura.dg=ps.hitachi-solutions.com@lists.freeradius.org> On Behalf Of Alan DeKok Sent: Friday, July 19, 2019 7:57 PM To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: [!]Re: I want to branch an ldap attribute On Jul 18, 2019, at 10:33 PM, 西村暢敦 / NISHIMURA，NOBUATSU <nobuatsu.nishimura.dg@ps.hitachi-solutions.com> wrote:.
I want to get vlanId (radiusTunnelPrivateGroupId) of the user I want to authenticate. Ldap query How should I write?
See LDAP documentation for how to write LDAP queries. Then, paste the query into the FreeRADIUS configuration.
You can do dynamic LDAP queries:
authorize { ... if (specific AP) { update reply { Tunnel-Private-Group-Id := "{ldap:ldap:///ou=Users,dc=edu,dc=com,uid?sub?radiusTunnelPrivateGroupId?}"
That isn't correct. The expansion uses %{...}.
} }
→ Failed parsing expanded string
Post the debug output. There is just *no* reason for failing to do this.
Is there a description method?
There's lots of documentation for both FreeRADIUS and for LDAP.
Can I get vlan registered in ldap with any uid?
That's a question for LDAP, not FreeRADIUS. Alan DeKok. - List info/subscribe/unsubscribe? See https://clicktime.symantec.com/3Jn9zUmALWM37pVmvREZ6F97Vc?u=http%3A%2F%2Fwww...
On Jul 22, 2019, at 5:02 AM, 西村暢敦 / NISHIMURA，NOBUATSU <nobuatsu.nishimura.dg@ps.hitachi-solutions.com> wrote:
authorize { ... if (specific AP) { update reply { Tunnel-Private-Group-Id := %{ldap:ldap:///ou=Users,dc=edu,dc=kkc,dc=imc,dc=com?uid?sub?uid=%u(radiusTunnelPrivateGroupId)} } }
It will be an error. Do you understand the cause?
You need to quote the string, as I said to do. See "man unlang" for documentation. if (specific AP) { update reply { Tunnel-Private-Group-Id := "%{ldap:ldap:///ou=Users,dc=edu,dc=kkc,dc=imc,dc=com?uid?sub?uid=%u(radiusTunnelPrivateGroupId)}" } }
Please tell me the solution.
Read the documentation.
Below is my debug output
You're using "radiusd -Xx" when ALL of the documentation, and posts EVERY DAY on this list say to use "radiusd -X" If you're going to ignore the documentation, you will have a hard time configuring the server. Alan DeKok.
Thanks Alan and Matthew. I'm sorry, my English is not good. Solved with the following. ------- #! /bin/sh # /usr/sbin/ldapvlan ldapsearch -x -LLL -h 10.0.0.xx -b dc=edu,dc=imc,dc=com \ -D cn=master,dc=edu,dc=imc,dc=com -W mypasswd \ '(uid='${1}')' radiusTunnelPrivateGroupId | sed -n 's/radiusTunnelPrivateGroupId: //p' ------- And then in the default faile I have authorize { ... if (specific AP) { update reply { Tunnel-Private-Group-Id := "%{exec:/usr/sbin/ldapvlan %{User-Name}}" } } We have got vlanid. thanks n.n -----Original Message----- From: Freeradius-Users <freeradius-users-bounces+nobuatsu.nishimura.dg=ps.hitachi-solutions.com@lists.freeradius.org> On Behalf Of Alan DeKok Sent: Monday, July 22, 2019 7:56 PM To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: [!]Re: I want to branch an ldap attribute On Jul 22, 2019, at 5:02 AM, 西村暢敦 / NISHIMURA，NOBUATSU <nobuatsu.nishimura.dg@ps.hitachi-solutions.com> wrote:
authorize { ... if (specific AP) { update reply { Tunnel-Private-Group-Id := %{ldap:ldap:///ou=Users,dc=edu,dc=kkc,dc=imc,dc=com?uid?sub?uid=%u(radiusTunnelPrivateGroupId)} } }
It will be an error. Do you understand the cause?
You need to quote the string, as I said to do. See "man unlang" for documentation. if (specific AP) { update reply { Tunnel-Private-Group-Id := "%{ldap:ldap:///ou=Users,dc=edu,dc=kkc,dc=imc,dc=com?uid?sub?uid=%u(radiusTunnelPrivateGroupId)}" } }
Please tell me the solution.
Read the documentation.
Below is my debug output
You're using "radiusd -Xx" when ALL of the documentation, and posts EVERY DAY on this list say to use "radiusd -X" If you're going to ignore the documentation, you will have a hard time configuring the server. Alan DeKok. - List info/subscribe/unsubscribe? See https://clicktime.symantec.com/32xxRgbgA7qGH5v3rGs5yjb7Vc?u=http%3A%2F%2Fwww...
Please don’t ever bemoan your skill with English. I assure you it is much better than many native English speakers (myself included!) would fare in a great many languages, especially when discussing technical topics. Sent from my iPhone
On Jul 24, 2019, at 20:16, 西村暢敦 / NISHIMURA，NOBUATSU <nobuatsu.nishimura.dg@ps.hitachi-solutions.com> wrote:
Thanks Alan and Matthew.
I'm sorry, my English is not good.
Solved with the following.
------- #! /bin/sh # /usr/sbin/ldapvlan
ldapsearch -x -LLL -h 10.0.0.xx -b dc=edu,dc=imc,dc=com \ -D cn=master,dc=edu,dc=imc,dc=com -W mypasswd \ '(uid='${1}')' radiusTunnelPrivateGroupId | sed -n 's/radiusTunnelPrivateGroupId: //p' -------
And then in the default faile I have
authorize { ... if (specific AP) { update reply { Tunnel-Private-Group-Id := "%{exec:/usr/sbin/ldapvlan %{User-Name}}" } }
We have got vlanid.
thanks
n.n
-----Original Message----- From: Freeradius-Users <freeradius-users-bounces+nobuatsu.nishimura.dg=ps.hitachi-solutions.com@lists.freeradius.org> On Behalf Of Alan DeKok Sent: Monday, July 22, 2019 7:56 PM To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: [!]Re: I want to branch an ldap attribute
On Jul 22, 2019, at 5:02 AM, 西村暢敦 / NISHIMURA，NOBUATSU <nobuatsu.nishimura.dg@ps.hitachi-solutions.com> wrote: authorize { ... if (specific AP) { update reply { Tunnel-Private-Group-Id := %{ldap:ldap:///ou=Users,dc=edu,dc=kkc,dc=imc,dc=com?uid?sub?uid=%u(radiusTunnelPrivateGroupId)} } }
It will be an error. Do you understand the cause?
You need to quote the string, as I said to do. See "man unlang" for documentation.
if (specific AP) { update reply { Tunnel-Private-Group-Id := "%{ldap:ldap:///ou=Users,dc=edu,dc=kkc,dc=imc,dc=com?uid?sub?uid=%u(radiusTunnelPrivateGroupId)}" } }
Please tell me the solution.
Read the documentation.
Below is my debug output
You're using "radiusd -Xx" when ALL of the documentation, and posts EVERY DAY on this list say to use "radiusd -X"
If you're going to ignore the documentation, you will have a hard time configuring the server.
Alan DeKok.
- List info/subscribe/unsubscribe? See https://clicktime.symantec.com/32xxRgbgA7qGH5v3rGs5yjb7Vc?u=http%3A%2F%2Fwww...
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (4)
-
Alan DeKok -
Coy Hile -
Yuya Yanagi -
西村暢敦 / NISHIMURA，NOBUATSU