Fallback LDAP Attribute Value
Hi list, I have the following line in my ldap.attrmap file to pull back a users VLAN assignment:
replyItem Tunnel-Private-Group-ID destinationIndicator
The users file contains the following:
DEFAULT Ldap-Group == "allowed-access" Service-Type = Framed-User, Tunnel-Type = "VLAN", Tunnel-Medium-Type = "IEEE-802"
For the users which are in the "allowed-access" group those which have a value in the destinationIndicator attribute in LDAP work OK and are flipped into the appropriate VLAN. How do I specify a fallback so that if the user does not have this attribute set or it is empty then they are put into VLAN 666 for example. Thanks Steve -- Steven Carr Systems Development Officer SLS/ITS/Systems - (0191) 515 3953
I have the following line in my ldap.attrmap file to pull back a users VLAN assignment:
replyItem Tunnel-Private-Group-ID destinationIndicator
The users file contains the following:
DEFAULT Ldap-Group == "allowed-access" Service-Type = Framed-User, Tunnel-Type = "VLAN", Tunnel-Medium-Type = "IEEE-802"
For the users which are in the "allowed-access" group those which have a value in the destinationIndicator attribute in LDAP work OK and are flipped into the appropriate VLAN. How do I specify a fallback so that if the user does not have this attribute set or it is empty then they are put into VLAN 666 for example.
Use unlang. Put something like this in post-auth: if(reply:Tunnel-Private-Group-ID == "") { update reply { Tunnel-Private-Group-ID = "666" } } Ivan Kalik Kalik Informatika ISP
Hi Ivan On 7/7/09 14:29, Ivan Kalik wrote:
Use unlang. Put something like this in post-auth:
if(reply:Tunnel-Private-Group-ID == "") { update reply { Tunnel-Private-Group-ID = "666" } }
I've tried this in both the default and inner-tunnel post-auth sections and neither returned the value 666 in the Radius Accept. Do I need to add anything as a placeholder in the users config file? Thanks Steve -- Steven Carr Systems Development Officer SLS/ITS/Systems - (0191) 515 3953
On 7/7/09 15:48, Steven Carr wrote:
Hi Ivan
On 7/7/09 14:29, Ivan Kalik wrote:
Use unlang. Put something like this in post-auth:
if(reply:Tunnel-Private-Group-ID == "") { update reply { Tunnel-Private-Group-ID = "666" } }
I've tried this in both the default and inner-tunnel post-auth sections and neither returned the value 666 in the Radius Accept. Do I need to add anything as a placeholder in the users config file?
Digging into debug came back with:
++? if (reply:Tunnel-Private-Group-ID == "") (Attribute reply:Tunnel-Private-Group-ID was not found)
Steve -- Steven Carr Systems Development Officer SLS/ITS/Systems - (0191) 515 3953
Use unlang. Put something like this in post-auth:
if(reply:Tunnel-Private-Group-ID == "") { update reply { Tunnel-Private-Group-ID = "666" } }
I've tried this in both the default and inner-tunnel post-auth sections and neither returned the value 666 in the Radius Accept. Do I need to add anything as a placeholder in the users config file?
Digging into debug came back with:
++? if (reply:Tunnel-Private-Group-ID == "") (Attribute reply:Tunnel-Private-Group-ID was not found)
OK, try: if (!reply:Tunnel-Private-Group-ID) that should cover the case when there is no ldap attribute in user profile. If attribute can be empty or missing you will need to OR those two expessions. Ivan Kalik Kalik Informatika ISP
On 7/7/09 16:04, Ivan Kalik wrote:
OK, try:
if (!reply:Tunnel-Private-Group-ID)
that should cover the case when there is no ldap attribute in user profile. If attribute can be empty or missing you will need to OR those two expessions.
Thanks Ivan, the following in the post-auth section of the default file works:
if ((!reply:Tunnel-Private-Group-ID) || (reply:Tunnel-Private-Group-ID == "")) { update reply { Tunnel-Private-Group-ID = "666" } }
Steve -- Steven Carr Systems Development Officer SLS/ITS/Systems - (0191) 515 3953
On 7/7/09 16:16, Steven Carr wrote:
Thanks Ivan, the following in the post-auth section of the default file works:
if ((!reply:Tunnel-Private-Group-ID) || (reply:Tunnel-Private-Group-ID == "")) { update reply { Tunnel-Private-Group-ID = "666" } }
OK for my next part on this subject, this returns the values for all users regardless of what they are connecting to. Is it possible to either restrict this value to only be returned to a particular huntgroup or to remove this value from being returned from the huntgroups that don't need it. We are doing 802.1x and only want the 802.1x attributes to be returned to our cisco switches. E.g. I have a huntgroup called ciscoswitches which has all of our switches listed in it. In the users file I have the following declaration to add the 802.1x attributes: DEFAULT Huntgroup-Name == "ciscoswitches" Service-Type = Framed-User, Tunnel-Type = "VLAN", Tunnel-Medium-Type = "IEEE-802", Fall-Through = Yes The "Tunnel-Private-Group-ID" is then added from the post-auth, which is fine for this huntgroup, but I don't want it there for the rest of them. Thanks Steve -- Steven Carr Systems Development Officer SLS/ITS/Systems - (0191) 515 3953
Thanks Ivan, the following in the post-auth section of the default file works:
if ((!reply:Tunnel-Private-Group-ID) || (reply:Tunnel-Private-Group-ID == "")) { update reply { Tunnel-Private-Group-ID = "666" } }
OK for my next part on this subject, this returns the values for all users regardless of what they are connecting to. Is it possible to either restrict this value to only be returned to a particular huntgroup or to remove this value from being returned from the huntgroups that don't need it.
Yes. if(((!reply:...) || (reply:... = "")) && Huntgroup-Name = "whatever") Ivan Kalik Kalik Informatika ISP
On 7/7/09 17:01, Ivan Kalik wrote:
Yes.
if(((!reply:...) || (reply:... = "")) && Huntgroup-Name = "whatever")
This works for those users that have the attribute set as a fallback measure but how do I stop it from returning the attribute when it was retrieved from LDAP, again I only want this attribute to be returned when the are calling from a particular huntgroup. So the scenario is - if they are calling from huntgroup "ciscoswitches" then we return the attributes either the value from LDAP for the VLAN or the fallback value from the post auth, if they are not calling from the huntgroup then don't return these attributes. Thanks Steve -- Steven Carr Systems Development Officer SLS/ITS/Systems - (0191) 515 3953
On 7/7/09 17:01, Ivan Kalik wrote:
Yes.
if(((!reply:...) || (reply:... = "")) && Huntgroup-Name = "whatever")
This works for those users that have the attribute set as a fallback measure but how do I stop it from returning the attribute when it was retrieved from LDAP, again I only want this attribute to be returned when the are calling from a particular huntgroup.
So the scenario is - if they are calling from huntgroup "ciscoswitches" then we return the attributes either the value from LDAP for the VLAN or the fallback value from the post auth, if they are not calling from the huntgroup then don't return these attributes.
If I understand you well: if(Huntgroup-Name == "ciscoswitches") { if((!reply:...) || (reply:... = "")) { update reply { Tunnel-Private-Group-ID = "666" } } } else { update reply { Tunnel-Private-Group-ID -= "%{reply:Tunnel-Private-Group-ID}" } } Extra bit will remove VLAN ID assigned from ldap for those not in ciscoswitches huntgroup. Ivan Kalik Kalik Informatika ISP
On 8/7/09 08:18, Steven Carr wrote:
On 7/7/09 17:01, Ivan Kalik wrote:
Yes.
if(((!reply:...) || (reply:... = "")) && Huntgroup-Name = "whatever")
This works for those users that have the attribute set as a fallback measure but how do I stop it from returning the attribute when it was retrieved from LDAP, again I only want this attribute to be returned when the are calling from a particular huntgroup.
So the scenario is - if they are calling from huntgroup "ciscoswitches" then we return the attributes either the value from LDAP for the VLAN or the fallback value from the post auth, if they are not calling from the huntgroup then don't return these attributes.
Is it not possible to use something like... if ((!Huntgroup-Name) || (Huntgroup-Name != "ciscoswitches")) { update reply { Tunnel-Private-Group-ID -= Tunnel-Type -= Tunnel-Medium-Type -= } } I did try this and it came back with: ERROR: No value given for attribute Tunnel-Private-Group-ID. There must be an easy way to strip attributes from being returned? Steve -- Steven Carr Systems Development Officer SLS/ITS/Systems - (0191) 515 3953
Is it not possible to use something like...
if ((!Huntgroup-Name) || (Huntgroup-Name != "ciscoswitches")) { update reply { Tunnel-Private-Group-ID -= Tunnel-Type -= Tunnel-Medium-Type -= } }
I did try this and it came back with: ERROR: No value given for attribute Tunnel-Private-Group-ID.
Obviously not. There is no wildcard. If you want wildcard use attribute filter instead of update reply. Ivan Kalik Kalik Informatika ISP
On 8/7/09 14:19, Ivan Kalik wrote:
Obviously not. There is no wildcard. If you want wildcard use attribute filter instead of update reply.
Tried that too, but the attribute filter only seems to allow you to filter on items that you want to be returned, rather than filter out those that you don't want to be returned :( Steve -- Steven Carr Systems Development Officer SLS/ITS/Systems - (0191) 515 3953
On 8/7/09 14:19, Ivan Kalik wrote:
Obviously not. There is no wildcard. If you want wildcard use attribute filter instead of update reply.
Tried that too, but the attribute filter only seems to allow you to filter on items that you want to be returned, rather than filter out those that you don't want to be returned :(
Well, reply attributes don't appear from nowhere - *you* configure them! List what you want to leave in the packet (lets say Service-Type) - rest will be deleted. Ivan Kalik Kalik Informatika ISP
On 8/7/09 14:36, Ivan Kalik wrote:
Well, reply attributes don't appear from nowhere - *you* configure them! List what you want to leave in the packet (lets say Service-Type) - rest will be deleted.
That is the issue, I do not know what attributes we do want, only what we don't want. We only want to send back the VLAN switching dot1x attributes if the request comes from a particular huntgroup (containing devices that are allowed to do dot1x), the problem being one of these attributes is stored in LDAP (the actual VLAN number to put someone in). The idea is that the RADIUS server is also going to process other authentication requests aswell as dot1x requests, but to ensure that nothing gets triggered on other devices (Wireless etc.) these attributes can't be sent back devices that aren't allowed for dot1x. We can't be the only people wanting to do this? Or do you have any other suggestions as to how this can be achieved? Thanks Steve -- Steven Carr Systems Development Officer SLS/ITS/Systems - (0191) 515 3953
Steven Carr wrote:
That is the issue, I do not know what attributes we do want, only what we don't want.
If you don't want the attributes, it would be simplest to not add them in the first place.
We only want to send back the VLAN switching dot1x attributes if the request comes from a particular huntgroup (containing devices that are allowed to do dot1x), the problem being one of these attributes is stored in LDAP (the actual VLAN number to put someone in).
You can map that VLAN number to a server-side attribute. Then, copy it to the correct tunnel attribute when you want. e.g. map it to Tmp-String-0, (ldap.attrmap), and then do: if (... i want to send vlan) { update reply { Tunnel-Private-Group-Id = "%{Tmp-String-0}" ... } } Alan DeKok.
On 8/7/09 15:07, Alan DeKok wrote:
You can map that VLAN number to a server-side attribute. Then, copy it to the correct tunnel attribute when you want.
e.g. map it to Tmp-String-0, (ldap.attrmap), and then do:
if (... i want to send vlan) { update reply { Tunnel-Private-Group-Id = "%{Tmp-String-0}" ... } }
OK getting closer... ldap.attrmap contains: replyItem Tmp-String-0 destinationindicator post-auth section contains: if ((!reply:Tmp-String-0) || (reply:Tmp-String-0 == "")) { update reply { Tunnel-Private-Group-Id = "666" } } else { update reply { Tunnel-Private-Group-Id = "%{Tmp-String-0}" } } debug output shows: ++? if ((!reply:Tmp-String-0) || (reply:Tmp-String-0 == "")) ?? Evaluating !(reply:Tmp-String-0) -> TRUE ?? Evaluating (reply:Tmp-String-0 == "") -> FALSE ++? if ((!reply:Tmp-String-0) || (reply:Tmp-String-0 == "")) -> FALSE ++- entering else else expand: %{Tmp-String-0} -> So Tmp-String-0 supposedly is there, and isn't empty, but I cant get the data out of it. In the packet back it is set to: Tunnel-Private-Group-Id:0 = "" What am I missing? Steve -- Steven Carr Systems Development Officer SLS/ITS/Systems - (0191) 515 3953
On 8/7/09 16:21, Ivan Kalik wrote:
e.g. map it to Tmp-String-0, (ldap.attrmap), and then do:
if (... i want to send vlan) { update reply { Tunnel-Private-Group-Id = "%{Tmp-String-0}"
reply:Tmp-String-0
Pants! I was almost certain I'd tried that previously and it had failed. Tis working now though :) Thanks Steve -- Steven Carr Systems Development Officer SLS/ITS/Systems - (0191) 515 3953
participants (3)
-
Alan DeKok -
Ivan Kalik -
Steven Carr