How to configure USERS file to assign the VLAN ID according to LDAP group name?
Hi Everyone, I configure a Freeradius server working with LDAP. The group name in LDAP is used as the VLAN ID issued by radius too. This is my *users* file configuration: *DEFAULT Group == "1"* * Auth-Type = LDAP,* * Tunnel-Type = 13,* * Tunnel-Medium-Type = 6,* * Tunnel-Private-Group-ID = 1,* * Fall-Through = 1* ** *DEFAULT Group == "10"* * Auth-Type = LDAP,* * Tunnel-Type = 13,* * Tunnel-Medium-Type = 6,* * Tunnel-Private-Group-ID = 10,* * Fall-Through = 1* ** Now, it works fine except I have to add more lines manual once I add one more group in LDAP. Because freeradius is going to assign the VLAN ID by matching the Group name replied by LDAP with the configured Group name in* users* file. Can I configure the *Group* as a variable containing the value of the group name in LDAP, and radius can assign the Tunnel-Private-Group-ID by recognizing the variable? Such as programming: *Tunnel-Private-Group-ID = Group * ** Thank you very much! Richard
"richard Bai" <baixin@gmail.com> wrote:
This is my *users* file configuration: *DEFAULT Group == "1"*
Why put asterisks around every line?
* Auth-Type = LDAP,*
1) Auth-Type belongs on the first line, "radiusd -X" will tell you that 2) Setting Auth-Type = LDAP is probably wrong.
Now, it works fine except I have to add more lines manual once I add one more group in LDAP.
Except the "Group" attribute is for Unix groups, not LDAP groups. Either your system *doesn't* work at all, or the "users" file entries you included above are *not* what you're using.
Such as programming: *Tunnel-Private-Group-ID = Group *
See doc/variables.txt. It explains how to copy the contents of one attribute to another attribute. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
Hi, Alan, Thanks for reply. Right now the situation is the RADIUS can authenticate the user in LDAP. But the group attribute does work. So, the vlan ID can not be assigned. Could you tell me what should be correct configuration in users file. Richard ----- Original Message ----- From: "Alan DeKok" <aland@deployingradius.com> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Tuesday, October 31, 2006 6:19 PM Subject: Re: How to configure USERS file to assign the VLAN ID according toLDAP group name?
"richard Bai" <baixin@gmail.com> wrote:
This is my *users* file configuration: *DEFAULT Group == "1"*
Why put asterisks around every line?
* Auth-Type = LDAP,*
1) Auth-Type belongs on the first line, "radiusd -X" will tell you that 2) Setting Auth-Type = LDAP is probably wrong.
Now, it works fine except I have to add more lines manual once I add one more group in LDAP.
Except the "Group" attribute is for Unix groups, not LDAP groups.
Either your system *doesn't* work at all, or the "users" file entries you included above are *not* what you're using.
Such as programming: *Tunnel-Private-Group-ID = Group *
See doc/variables.txt. It explains how to copy the contents of one attribute to another attribute.
Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
"Richard" <baixin@gmail.com> wrote:
Right now the situation is the RADIUS can authenticate the user in LDAP. But the group attribute does work.
As I said before, "Group" is for Unix groups. If you want to check LDAP groups, you should use the LDAP-Group attribute. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
----- Original Message ----- From: "Alan DeKok" <aland@deployingradius.com> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Tuesday, October 31, 2006 11:30 PM Subject: Re: How to configure USERS file to assign the VLAN ID accordingtoLDAP group name?
"Richard" <baixin@gmail.com> wrote:
Right now the situation is the RADIUS can authenticate the user in LDAP. But the group attribute does work.
As I said before, "Group" is for Unix groups. If you want to check LDAP groups, you should use the LDAP-Group attribute.
Alan DeKok.
Besides this one, any other configuration need to be modifie? Actually I tried Ldap-Group. It seems doesn't work. Thanks
-- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi Alan, I changed "Group" to "Ldap-Group" in *users* file, however, Freeradius can not find the group name I specify in *users* file. I think the reason is the *basedn* ("ou=people,dc=richard,dc=com") I set in *radiusd.conf* is for user only, the group is binded with a different *basedn*("ou=group,dc=richard,dc=com"). So, ldap_groupcmp() can not find the group in the *basedn* ("ou=people,dc=richard,dc=com"). Since I don't want to authenticate the groupmembership, just want to get the name of the group to which the user is belong, I don't think I need to configure any group authentication for LDAP. The result is the user is authenticated, but the *Tunnel-Private-Group-ID*is not assigned in the Access-Accept message because no group name matches. When I changed it back, it works fine. I am not sure what "Group" represents in Freeradius. I only configured group "1" and group "10" in LDAP. I did test as follow. I changed name of group "10" to group "20" in LDAP, and keep all other configurations. When the user who was in group "10" before and in group "20" now tried to be authenticated, it is successful except no *Tunnel-Private-Group-ID *assigned since there is no group "20" in *users* file. So, I assume the "Group" does have something to do with ldap group. I am using SuSE enterprise server 10 and the OpenLDAP integrated with it. Do you think the groups configured in LDAP has some relationship with the Unix group you mentioned? Richard On 10/31/06, Alan DeKok <aland@deployingradius.com> wrote:
"Richard" <baixin@gmail.com> wrote:
Right now the situation is the RADIUS can authenticate the user in LDAP. But the group attribute does work.
As I said before, "Group" is for Unix groups. If you want to check LDAP groups, you should use the LDAP-Group attribute.
Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (3)
-
Alan DeKok -
Richard -
richard Bai