Thank you Alan but i don't find the documentation to use attribut recovered with module ldap. I must use checkItem or replyItem and "&reply:attribute" ? Vince 2016-01-06 17:42 GMT+01:00 Alan DeKok <aland@deployingradius.com>:

On Jan 6, 2016, at 11:38 AM, vince technical address < vince.technicaladdress@gmail.com> wrote:\

...

I currently use the rlm_ldap module to retrieve an entry corresponding to a filter defined in the authorize section. After (but always in section authorize) I would use the value of an LDAP attribute recovered with unlang.

Is it possible ?

Yes. In v2, see raddb/ldap.attrmap.

And look on http://wiki.freeradius.org/ This is documented.

...

Example :

authorize { ldap if(attribute == "qwerty") { reject } }

With "attribute"is the value of the attribute has been recovered with module ldap. (it is an idea to overcome the fact that xlat ldap does not enable failover).

Version 3 allows for fail-over in xlat. Upgrade.

Alan DeKok.

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Thank you Alan. How we can use fail-over with xlat and ldap in section authorize in freeradius 3 ? Vince 2016-01-06 17:56 GMT+01:00 Alan DeKok <aland@deployingradius.com>:

On Jan 6, 2016, at 11:51 AM, vince technical address < vince.technicaladdress@gmail.com> wrote:

...

Thank you Alan but i don't find the documentation to use attribut

recovered

...

with module ldap. I must use checkItem or replyItem and "&reply:attribute" ?

The documentation makes it clear what happens.

The checkItem maps an LDAP attribute to the "check" or "control" list.

The replyItem maps an LDAP attribute to the reply list.

Either way, you have to give it a RADIUS attribute where the data will be stored.

Then, just refer to the attribute as normal. See "man unlang".

Alan DeKok.

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html