Map LDAP Attribute to RADIUS Attribute
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 All: I am running FreeRADIUS version 1.1.2 on Debian Linux (Stable x86). I am trying to map an LDAP attribute to a RADIUS attribute. A little background, we have a RADIUS client that needs to make decisions based on an LDAP attribute (we'll call it User-Category). Based on the value of this attribute the end user will be given rights on the network. So, I setup my ldap.attrmap with *only* the following line: replyItem User-Category orgPrimaryAffiliation I setup the following config for rlm_ldap: server = "ldapserver.org.com" identity = "cn=Radius_admin,ou=Special Users,dc=org,dc=com" password = 12345 basedn = "dc=org,dc=com" filter = "(&(objectclass=*) (orgShortid=%{Stripped- User-Name:-%{User-Name}}))" base_filter = "(objectclass=*)" # port = 636 port = 389 The following debug logs show the successful authentication of the user and the mapping of the attributes: rad_recv: Access-Request packet from host 127.0.0.1:32904, id=192, length=58 User-Name = "mytestuser" User-Password = "12345" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "mytestuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_ldap: - authorize rlm_ldap: performing user authorization for mytestuser radius_xlat: '(&(objectclass=*) (orgShortid=mytestuser))' radius_xlat: 'dc=org,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=org,dc=com, with filter (& (objectclass=*) (orgShortid=mytestuser)) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Adding orgPrimaryAffiliation as User-Category, value student & op=11 rlm_ldap: Setting Auth-Type = ldap rlm_ldap: user mytestuser authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 4 modcall: leaving group authorize (returns ok) for request 4 rad_check_password: Found Auth-Type ldap auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group LDAP for request 4 rlm_ldap: - authenticate rlm_ldap: login attempt by "mytestuser" with password "12345" rlm_ldap: user DN: orgUUID=53d66879-e0a0- da8f-4c49-514b567713ad,ou=People,dc=org,dc=com rlm_ldap: (re)connect to ldapserver.org.com:389, authentication 1 rlm_ldap: bind as orgUUID=53d66879-e0a0- da8f-4c49-514b567713ad,ou=People,dc=org,dc=com/12345 to ldapserver.org.com:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user mytestuser authenticated succesfully modcall[authenticate]: module "ldap" returns ok for request 4 modcall: leaving group LDAP (returns ok) for request 4 Sending Access-Accept of id 192 to 127.0.0.1 port 32904 Finished request 4 The problem is that I never see the RADIUS server return the "User- Category" attribute back to the RADIUS client. It seems to only want to send the "Access-Accept" or "Access-Reject" message with no User- Category value. I tried including the "User-Category" in the request with no luck. I also modified the "attrs" file to include this attribute: DEFAULT Service-Type == Framed-User, Service-Type == Login-User, Login-Service == Telnet, Login-Service == Rlogin, Login-Service == TCP-Clear, Login-TCP-Port <= 65536, Framed-IP-Address == 255.255.255.254, Framed-IP-Netmask == 255.255.255.255, Framed-Protocol == PPP, Framed-Protocol == SLIP, Framed-Compression == Van-Jacobson-TCP-IP, Framed-MTU >= 576, Framed-Filter-ID =* ANY, Reply-Message =* ANY, User-Category =* ANY, Proxy-State =* ANY, Session-Timeout <= 28800, Idle-Timeout <= 600, Port-Limit <= 2 But no luck there either. Any help is greatly appreciated. Thank You, Paul - -- Paul Asadoorian Email: paul@pauldotcom.com Web: http://pauldotcom.com IRC: #pauldotcom | irc.freenode.net Fingerprint: 2693 0204 8497 2E5F 4853 11D5 1153 6151 487F E094 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.1 (Darwin) iD8DBQFEvjotEVNhUUh/4JQRAqM/AKCWYfgBERhaBQ/xKUDMGD552JPB4QCfTP+v knyeEwAg7Annq9xXcdwK8s0= =Gzks -----END PGP SIGNATURE-----
I am running FreeRADIUS version 1.1.2 on Debian Linux (Stable x86). I am trying to map an LDAP attribute to a RADIUS attribute. A little background, we have a RADIUS client that needs to make decisions based on an LDAP attribute (we'll call it User-Category). Based on the value of this attribute the end user will be given rights on the network. So, I setup my ldap.attrmap with *only* the following line:
replyItem User-Category orgPrimaryAffiliation
rlm_ldap: Adding orgPrimaryAffiliation as User-Category, value
auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group LDAP for request 4 rlm_ldap: - authenticate rlm_ldap: login attempt by "mytestuser" with password "12345" rlm_ldap: user DN: orgUUID=53d66879-e0a0- da8f-4c49-514b567713ad,ou=People,dc=org,dc=com rlm_ldap: (re)connect to ldapserver.org.com:389, authentication 1 rlm_ldap: bind as orgUUID=53d66879-e0a0- da8f-4c49-514b567713ad,ou=People,dc=org,dc=com/12345 to ldapserver.org.com:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user mytestuser authenticated succesfully modcall[authenticate]: module "ldap" returns ok for request 4 modcall: leaving group LDAP (returns ok) for request 4 Sending Access-Accept of id 192 to 127.0.0.1 port 32904 Finished request 4
Ok everything seems ok untill now...
The problem is that I never see the RADIUS server return the "User- Category" attribute back to the RADIUS client. It seems to only want to send the "Access-Accept" or "Access-Reject" message with no User- Category value. I tried including the "User-Category" in the request with no luck. I also modified the "attrs" file to include this attribute:
DEFAULT Service-Type == Framed-User, Service-Type == Login-User, Login-Service == Telnet, Login-Service == Rlogin, Login-Service == TCP-Clear, Login-TCP-Port <= 65536, Framed-IP-Address == 255.255.255.254, Framed-IP-Netmask == 255.255.255.255, Framed-Protocol == PPP, Framed-Protocol == SLIP, Framed-Compression == Van-Jacobson-TCP-IP, Framed-MTU >= 576, Framed-Filter-ID =* ANY, Reply-Message =* ANY, User-Category =* ANY, Proxy-State =* ANY, Session-Timeout <= 28800, Idle-Timeout <= 600, Port-Limit <= 2
But no luck there either. Any help is greatly appreciated.
Yes, but I don't think you can create a new Radius attribute like this. You should at least declare it in a dictionnary (wince a Radius attribute corresponds to a number in fact). See /etc/raddb/dictionnary and any Included files. Can anyone confirm my analysis and propose a procedure to create new attributes ? Isn't i necessary to register new attributes/number somewhere ? Is it possible to define "private attributes" ? Regards, Thibault
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Thibault, Thank you for reviewing my post. Here is a little more information: The RADIUS client is actually an Aruba wireless controller. It had an attribute already defined called "User-Category". I also checked the dictionary file for "User-Category" and this is what I found: # grep User-Category * dictionary.freeradius.internal:ATTRIBUTE User- Category 1029 string I am happy to change my attribute to something more standard or different if this seems to be the problem Thank You! Paul On Jul 19, 2006, at 10:34 AM, Thibault Le Meur wrote:
I am running FreeRADIUS version 1.1.2 on Debian Linux (Stable x86). I am trying to map an LDAP attribute to a RADIUS attribute. A little background, we have a RADIUS client that needs to make decisions based on an LDAP attribute (we'll call it User-Category). Based on the value of this attribute the end user will be given rights on the network. So, I setup my ldap.attrmap with *only* the following line:
replyItem User-Category orgPrimaryAffiliation
rlm_ldap: Adding orgPrimaryAffiliation as User-Category, value
auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group LDAP for request 4 rlm_ldap: - authenticate rlm_ldap: login attempt by "mytestuser" with password "12345" rlm_ldap: user DN: orgUUID=53d66879-e0a0- da8f-4c49-514b567713ad,ou=People,dc=org,dc=com rlm_ldap: (re)connect to ldapserver.org.com:389, authentication 1 rlm_ldap: bind as orgUUID=53d66879-e0a0- da8f-4c49-514b567713ad,ou=People,dc=org,dc=com/12345 to ldapserver.org.com:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user mytestuser authenticated succesfully modcall[authenticate]: module "ldap" returns ok for request 4 modcall: leaving group LDAP (returns ok) for request 4 Sending Access-Accept of id 192 to 127.0.0.1 port 32904 Finished request 4
Ok everything seems ok untill now...
The problem is that I never see the RADIUS server return the "User- Category" attribute back to the RADIUS client. It seems to only want to send the "Access-Accept" or "Access-Reject" message with no User- Category value. I tried including the "User-Category" in the request with no luck. I also modified the "attrs" file to include this attribute:
DEFAULT Service-Type == Framed-User, Service-Type == Login-User, Login-Service == Telnet, Login-Service == Rlogin, Login-Service == TCP-Clear, Login-TCP-Port <= 65536, Framed-IP-Address == 255.255.255.254, Framed-IP-Netmask == 255.255.255.255, Framed-Protocol == PPP, Framed-Protocol == SLIP, Framed-Compression == Van-Jacobson-TCP-IP, Framed-MTU >= 576, Framed-Filter-ID =* ANY, Reply-Message =* ANY, User-Category =* ANY, Proxy-State =* ANY, Session-Timeout <= 28800, Idle-Timeout <= 600, Port-Limit <= 2
But no luck there either. Any help is greatly appreciated.
Yes, but I don't think you can create a new Radius attribute like this. You should at least declare it in a dictionnary (wince a Radius attribute corresponds to a number in fact).
See /etc/raddb/dictionnary and any Included files.
Can anyone confirm my analysis and propose a procedure to create new attributes ? Isn't i necessary to register new attributes/number somewhere ? Is it possible to define "private attributes" ?
Regards, Thibault
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/ users.html
- -- Paul Asadoorian Email: paul@pauldotcom.com Web: http://pauldotcom.com IRC: #pauldotcom | irc.freenode.net Fingerprint: 2693 0204 8497 2E5F 4853 11D5 1153 6151 487F E094 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.1 (Darwin) iD8DBQFEvkpOEVNhUUh/4JQRAkLYAJ9A9E//OYrXhxqDL1c3R9Pug6DrdQCfcuol nHLn4xrMTZwDskv6eLGrG40= =lqlM -----END PGP SIGNATURE-----
Paul Asadoorian wrote:
The RADIUS client is actually an Aruba wireless controller. It had an attribute already defined called "User-Category". I also checked the
Ok, you should get Aruba's dictionary, or ask them what their enterprise number + the attribute number is. That attribute certainly doesn't seem to be in the FreeRadius dictionary.aruba Maybe Aruba-User-Role?
dictionary file for "User-Category" and this is what I found:
# grep User-Category * dictionary.freeradius.internal:ATTRIBUTE User-Category 1029 string
Ah, ok. That's a FreeRadius internal attribute. It'll never appear on the wire, it's intended for use inside the server e.g. as a classification/matching attribute. You'll have to name whatever Aruba's attribute is differently.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Thanks Phil! That seemed to do the trick, I now get: Sending Access-Accept of id 141 to 127.0.0.1 port 32908 Aruba-User-Role = "student" Thanks to all for the assistance. Paul On Jul 19, 2006, at 12:13 PM, Phil Mayers wrote:
Paul Asadoorian wrote:
The RADIUS client is actually an Aruba wireless controller. It had an attribute already defined called "User-Category". I also checked the
Ok, you should get Aruba's dictionary, or ask them what their enterprise number + the attribute number is. That attribute certainly doesn't seem to be in the FreeRadius dictionary.aruba
Maybe Aruba-User-Role?
dictionary file for "User-Category" and this is what I found: # grep User-Category * dictionary.freeradius.internal:ATTRIBUTE User- Category 1029 string
Ah, ok. That's a FreeRadius internal attribute. It'll never appear on the wire, it's intended for use inside the server e.g. as a classification/matching attribute.
You'll have to name whatever Aruba's attribute is differently. - List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html
- -- Paul Asadoorian Email: paul@pauldotcom.com Web: http://pauldotcom.com IRC: #pauldotcom | irc.freenode.net Fingerprint: 2693 0204 8497 2E5F 4853 11D5 1153 6151 487F E094 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.1 (Darwin) iD8DBQFEvoBsEVNhUUh/4JQRAgEeAKDTsfYKpoStI4Y11nV18/BoUrr4YQCePO7f bvf5ssfAkHTMvICk09aHJkQ= =847J -----END PGP SIGNATURE-----
Paul Asadoorian <paul@pauldotcom.com> wrote:
The RADIUS client is actually an Aruba wireless controller. It had an attribute already defined called "User-Category".
Where? In the NAS documentation, or in the Aruba dictionary? Please look at the "dictionary.aruba" file. It contains pre-defined Aruba attributes that do not conflict with other attributes in the dictionaries. Alan DeKok.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The "User-Category" was in the pull-down on the menu where you map attributes to roles on the controller. Not certain why it was there if you are not supposed to use it. I will bring up this issue with the vendor (they are pretty good and play nice with standards and open-source). I did make it work by using the Aruba attribute "Aruba-User-Role". Works like a champ, thanks for all of your help. Paul On Jul 19, 2006, at 1:59 PM, Alan DeKok wrote:
Paul Asadoorian <paul@pauldotcom.com> wrote:
The RADIUS client is actually an Aruba wireless controller. It had an attribute already defined called "User-Category".
Where? In the NAS documentation, or in the Aruba dictionary?
Please look at the "dictionary.aruba" file. It contains pre-defined Aruba attributes that do not conflict with other attributes in the dictionaries.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/ users.html
- -- Paul Asadoorian Email: paul@pauldotcom.com Web: http://pauldotcom.com IRC: #pauldotcom | irc.freenode.net Fingerprint: 2693 0204 8497 2E5F 4853 11D5 1153 6151 487F E094 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.1 (Darwin) iD8DBQFEvpGFEVNhUUh/4JQRAtJcAJ95adEJGcieaxKWZnFuc/9CAKvk2QCfVcij YBa5olq5PnqrIMJin8uGlaw= =+mJO -----END PGP SIGNATURE-----
Paul Asadoorian <paul@pauldotcom.com> wrote:
The "User-Category" was in the pull-down on the menu where you map attributes to roles on the controller. Not certain why it was there if you are not supposed to use it.
The vendor's GUI is not the same as what's available in FreeRADIUS. Alan DeKok.
Thibault Le Meur wrote:
with no luck. I also modified the "attrs" file to include this attribute:
But no luck there either. Any help is greatly appreciated.
Yes, but I don't think you can create a new Radius attribute like this. You should at least declare it in a dictionnary (wince a Radius attribute corresponds to a number in fact).
See /etc/raddb/dictionnary and any Included files.
Can anyone confirm my analysis and propose a procedure to create new attributes ?
Correct, attributes are created by editing the dictionary. The "attrs" file is for the proxy attribute filtering module.
Isn't i necessary to register new attributes/number somewhere ? Is it
Yes in principle - you can obtain an enterprise number, then in dictionary do: VENDOR MyName MyEnterpriseNumber ATTRIBUTE My-Attribute-1 1 string MyName ATTRIBUTE My-Attribute-2 2 ipaddr MyName ...however, burning through the limited number of enterprise numbers for one attribute is a bit wasteful.
possible to define "private attributes" ?
Yes. Attributes sent over the wire should be either existing, registered attributes, or vendor-specific attributes, using an IANA enterprise number if need be. However if you're *certain* the client and server will never leave your network, then you can re-use any number you like. Better yet is to use an existing attribute - it is highly unlikely you're doing something no-one else has ever done. What is the client? Can you use the "Class" attribute, which is intended exactly for this?
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Jul 19, 2006, at 11:09 AM, Phil Mayers wrote:
What is the client? Can you use the "Class" attribute, which is intended exactly for this?
Hmmm, appears that the Class attribute is octects: dictionary.rfc2865:ATTRIBUTE Class 25 octets The value I am getting back from the LDAP attribute is a string, i.e. "student" or "staff" or "faculty" (in case anyone was wondering whether or not this is an edu or not :) My guess is this will not work? The client is actually an Aruba wireless controller. Thank You, Paul - -- Paul Asadoorian Email: paul@pauldotcom.com Web: http://pauldotcom.com IRC: #pauldotcom | irc.freenode.net Fingerprint: 2693 0204 8497 2E5F 4853 11D5 1153 6151 487F E094 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.1 (Darwin) iD8DBQFEvmvEEVNhUUh/4JQRAmb1AJ0fVJ0duMtvMdJySzytVVcZvoMwwACeM2Yw os5vd8i+sHyH5GLls9rRK3A= =+3ZV -----END PGP SIGNATURE-----
participants (4)
-
Alan DeKok -
Paul Asadoorian -
Phil Mayers -
Thibault Le Meur