Hi team, I am trying to assign VLANs to different realms, and only a few users to be part of a given realm. E.g.: user1 and user2 are part of @staff and should be assigned VLAN 123 user3 and user4 are part of @student and should be assigned 98 If a user is not part of a realm, he should be denied. Could you please help me on how I can assign a user to a realm? Thanks for your help. Regards, *Deepansha Gaur*
On May 29, 2024, at 5:45 PM, Deepansha Gaur <dgaur@ualberta.ca> wrote:
I am trying to assign VLANs to different realms, and only a few users to be part of a given realm. E.g.: user1 and user2 are part of @staff and should be assigned VLAN 123 user3 and user4 are part of @student and should be assigned 98 If a user is not part of a realm, he should be denied.
Could you please help me on how I can assign a user to a realm? Thanks for your help.
That depend on where your users are stored. LDAP? SQL? "users" file? Alan DeKok.
Hi Alan, Some users are in the "users" file and some in LDAP. I'm looking for assigning a realm to users in the users file or if I can assign a realm to a particular LDAP group. Regards, Deepansha Gaur ________________________________ From: Freeradius-Users <freeradius-users-bounces+dgaur=ualberta.ca@lists.freeradius.org> on behalf of Alan DeKok <aland@deployingradius.com> Sent: Wednesday, May 29, 2024 5:35 PM To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: Assign user to a realm. On May 29, 2024, at 5:45 PM, Deepansha Gaur <dgaur@ualberta.ca> wrote:
I am trying to assign VLANs to different realms, and only a few users to be part of a given realm. E.g.: user1 and user2 are part of @staff and should be assigned VLAN 123 user3 and user4 are part of @student and should be assigned 98 If a user is not part of a realm, he should be denied.
Could you please help me on how I can assign a user to a realm? Thanks for your help.
That depend on where your users are stored. LDAP? SQL? "users" file? Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On May 30, 2024, at 6:22 PM, Deepansha Gaur <dgaur@ualberta.ca> wrote:
Some users are in the "users" file and some in LDAP. I'm looking for assigning a realm to users in the users file or if I can assign a realm to a particular LDAP group.
The server comes with a lot of documentation. If you read it, you'll notice that the only references to "realms" is in the realms module, and the proxy configuration. i.e. there is no such thing as "assign a realm to a particular ldap group". The LDAP module doesn't have the concept of realms. If it it, that would be documented in mods-available/ldap. Plus, it's not clear at all what you mean by "assign a realm to a particular LDAP group". That description is vague, and means that no one can implement it. So the problem here isn't that FreeRADIUS can't do something, it's that the requirements are unclear. Please describe in DETAIL what you want the server to do. Be practical, and use real examples. e.g. A user logs in as "user@example.com". There is an LDAP group "foo". The server should only do group lookups in the LDAP group if the realm is "example.com". If you're going to implement detailed unlang policies, you need to describe those policies in detail. Unlang can't implement "I want to do stuff". Alan DeKok.
Thanks Alan. Right now, we are using vpn contexts to assign users to a particular vlan. Eg: if a user logs in with his ccid, he’s assigned a default VLAN, if they login with ccid@realm1 , they’re assigned Vlan 121. We’re now moving to freeradius and I want to implement the same using realms. Or if I can assign a vlan to a particular ldap group. Regards, Deepansha Gaur
On May 31, 2024, at 5:29 AM, Alan DeKok <aland@deployingradius.com> wrote:
On May 30, 2024, at 6:22 PM, Deepansha Gaur <dgaur@ualberta.ca> wrote:
Some users are in the "users" file and some in LDAP. I'm looking for assigning a realm to users in the users file or if I can assign a realm to a particular LDAP group.
The server comes with a lot of documentation. If you read it, you'll notice that the only references to "realms" is in the realms module, and the proxy configuration.
i.e. there is no such thing as "assign a realm to a particular ldap group". The LDAP module doesn't have the concept of realms. If it it, that would be documented in mods-available/ldap.
Plus, it's not clear at all what you mean by "assign a realm to a particular LDAP group". That description is vague, and means that no one can implement it. So the problem here isn't that FreeRADIUS can't do something, it's that the requirements are unclear.
Please describe in DETAIL what you want the server to do. Be practical, and use real examples. e.g.
A user logs in as "user@example.com".
There is an LDAP group "foo".
The server should only do group lookups in the LDAP group if the realm is "example.com".
If you're going to implement detailed unlang policies, you need to describe those policies in detail. Unlang can't implement "I want to do stuff".
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Jun 2, 2024, at 9:29 PM, Deepansha Gaur <dgaur@ualberta.ca> wrote:
Right now, we are using vpn contexts to assign users to a particular vlan. Eg: if a user logs in with his ccid, he’s assigned a default VLAN, if they login with ccid@realm1 , they’re assigned Vlan 121. We’re now moving to freeradius and I want to implement the same using realms.
You're saying essentially the same thing over and over again. that doesn't help. I had asked for more details, and you're not really giving them.
Or if I can assign a vlan to a particular ldap group.
Yes. Unlang allows you to (a) do LDAP group checks, and (b) assign VLANs. All you have to do is put the two together. The documentation gives dozens of examples of nearly everything the server can do. The LDAP module documentation shows how to connect the server to LDAP, and how to do LDAP group checking. Then in the default virtual server, you can do: if (LDAP-Group == "foo") { update reply { ... assign VLAN ... } } Alan DeKok.
That helps, Alan. Let me try with LDAP group checks. Thanks. Regards, Deepansha Gaur ________________________________ From: Freeradius-Users <freeradius-users-bounces+dgaur=ualberta.ca@lists.freeradius.org> on behalf of Alan DeKok <aland@deployingradius.com> Sent: Monday, June 3, 2024 4:54 AM To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: Assign user to a realm. On Jun 2, 2024, at 9:29 PM, Deepansha Gaur <dgaur@ualberta.ca> wrote:
Right now, we are using vpn contexts to assign users to a particular vlan. Eg: if a user logs in with his ccid, he’s assigned a default VLAN, if they login with ccid@realm1 , they’re assigned Vlan 121. We’re now moving to freeradius and I want to implement the same using realms.
You're saying essentially the same thing over and over again. that doesn't help. I had asked for more details, and you're not really giving them.
Or if I can assign a vlan to a particular ldap group.
Yes. Unlang allows you to (a) do LDAP group checks, and (b) assign VLANs. All you have to do is put the two together. The documentation gives dozens of examples of nearly everything the server can do. The LDAP module documentation shows how to connect the server to LDAP, and how to do LDAP group checking. Then in the default virtual server, you can do: if (LDAP-Group == "foo") { update reply { ... assign VLAN ... } } Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (2)
-
Alan DeKok -
Deepansha Gaur