Hello, thanks for taking the time to read this. And thanks in advance for the prompt replies! I've read nearly all the docs and How To's I could find and none of them (so far) address this. If I find an answer I'll be more than happy to draft a How To as I would suspect this a desired solution. So, I'm trying to use 802.1x dynamic VLAN assignment. I have this working when I conf the "users" file. However, I don't want to create/maintain the users file for 2,000 users! Is there an attribute in AD / LDAP I can use for the dynamic VLAN? Ideally I could do this at the "Group" level, such that when a user moves from one group to another their automagically assigned to the correct VLAN. If that's not possible, I COULD do it at the user level, but again kinda a hassle to maintain. Any thoughts / opinions would be GREATLY appreciated! In the mean time I'll keep reading! PS: The How To's have helped a LOT so far just getting to the point I'm at! Without them it would've taken me 10x longer! <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>
So, I'm trying to use 802.1x dynamic VLAN assignment. I have this working when I conf the "users" file. However, I don't want to create/maintain the users file for 2,000 users!
Is there an attribute in AD / LDAP I can use for the dynamic VLAN? Ideally I could do this at the "Group" level, such that when a user moves from one group to another their automagically assigned to the correct VLAN.
If you're using version 2.0.5 or higher you can do this with unlang as follows. This example sets the vlan based on the user's DN, but you should be able to modify it to look at your group membership attribute. Repeat for all relevant ldap groups. if (control:Ldap-UserDn =~ /ou=div,o=org/i) { update reply { Tunnel-Type := "VLAN" Tunnel-Medium-Type := "IEEE-802" Tunnel-Private-Group-Id := 9 } }
Dude, if it's this easy that would be SWEET! The How To's for TLS/PEAP are a little outdated so I'm working on getting the CA working now (CA.all doesn't exist anymore.) I'm ALL over this ASAP! Thanks! Gary -----Original Message----- From: freeradius-users-bounces+ggatten=waddell.com@lists.freeradius.org [mailto:freeradius-users-bounces+ggatten=waddell.com@lists.freeradius.or g] On Behalf Of Jason Alderfer Sent: Tuesday, August 18, 2009 2:18 PM To: FreeRadius users mailing list Subject: Re: Dynamic VLAN attribute in LDAP or AD?
So, I'm trying to use 802.1x dynamic VLAN assignment. I have this working when I conf the "users" file. However, I don't want to create/maintain the users file for 2,000 users!
Is there an attribute in AD / LDAP I can use for the dynamic VLAN? Ideally I could do this at the "Group" level, such that when a user moves from one group to another their automagically assigned to the correct VLAN.
If you're using version 2.0.5 or higher you can do this with unlang as follows. This example sets the vlan based on the user's DN, but you should be able to modify it to look at your group membership attribute. Repeat for all relevant ldap groups. if (control:Ldap-UserDn =~ /ou=div,o=org/i) { update reply { Tunnel-Type := "VLAN" Tunnel-Medium-Type := "IEEE-802" Tunnel-Private-Group-Id := 9 } } - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>
Gary Gatten wrote:
Dude, if it's this easy that would be SWEET! The How To's for TLS/PEAP are a little outdated so I'm working on getting the CA working now (CA.all doesn't exist anymore.)
See my message to the list of an hour or two ago. In v2, you have to do almost *nothing* to get PEAP working. Alan DeKok.
Where coudl I put this code Authorize, autenticate, postatuh, ldap module? 2009/8/18 Jason Alderfer <jha2@emu.edu>:
So, I'm trying to use 802.1x dynamic VLAN assignment. I have this working when I conf the "users" file. However, I don't want to create/maintain the users file for 2,000 users!
Is there an attribute in AD / LDAP I can use for the dynamic VLAN? Ideally I could do this at the "Group" level, such that when a user moves from one group to another their automagically assigned to the correct VLAN.
If you're using version 2.0.5 or higher you can do this with unlang as follows. This example sets the vlan based on the user's DN, but you should be able to modify it to look at your group membership attribute. Repeat for all relevant ldap groups.
if (control:Ldap-UserDn =~ /ou=div,o=org/i) { update reply { Tunnel-Type := "VLAN" Tunnel-Medium-Type := "IEEE-802" Tunnel-Private-Group-Id := 9 } }
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Where coudl I put this code Authorize, autenticate, postatuh, ldap module?
Authorize
So, I'm trying to use 802.1x dynamic VLAN assignment. I have this working when I conf the "users" file. However, I don't want to create/maintain the users file for 2,000 users!
Is there an attribute in AD / LDAP I can use for the dynamic VLAN? Ideally I could do this at the "Group" level, such that when a user moves from one group to another their automagically assigned to the correct VLAN.
If you're using version 2.0.5 or higher you can do this with unlang as follows. This example sets the vlan based on the user's DN, but you should be able to modify it to look at your group membership attribute. Repeat for all relevant ldap groups.
if (control:Ldap-UserDn =~ /ou=div,o=org/i) { update reply { Tunnel-Type := "VLAN" Tunnel-Medium-Type := "IEEE-802" Tunnel-Private-Group-Id := 9 } }
I'm assuming I can do roughly the same thing with NTLM_AUTH? I "have" to use NTLM_Auth for 8021x (right? - at least all docs say this), so if I don't HAVE to use LDAP all the better. TIA! Gary -----Original Message----- From: freeradius-users-bounces+ggatten=waddell.com@lists.freeradius.org [mailto:freeradius-users-bounces+ggatten=waddell.com@lists.freeradius.or g] On Behalf Of Jason Alderfer Sent: Tuesday, August 18, 2009 2:18 PM To: FreeRadius users mailing list Subject: Re: Dynamic VLAN attribute in LDAP or AD?
So, I'm trying to use 802.1x dynamic VLAN assignment. I have this working when I conf the "users" file. However, I don't want to create/maintain the users file for 2,000 users!
Is there an attribute in AD / LDAP I can use for the dynamic VLAN? Ideally I could do this at the "Group" level, such that when a user moves from one group to another their automagically assigned to the correct VLAN.
If you're using version 2.0.5 or higher you can do this with unlang as follows. This example sets the vlan based on the user's DN, but you should be able to modify it to look at your group membership attribute. Repeat for all relevant ldap groups. if (control:Ldap-UserDn =~ /ou=div,o=org/i) { update reply { Tunnel-Type := "VLAN" Tunnel-Medium-Type := "IEEE-802" Tunnel-Private-Group-Id := 9 } } - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>
So, by looking at this more carefully I'll have to do a bunch of if/else's or cases? What if for instance I have 500 departments/groups - 500 different vlans? I'll have to test each one? I guess what I was hoping to do was something like: Get attribute "n" for user y (where n = a value used for Tunnel-Private-Group-Id" THEN do the processing you mentioned: update reply { Tunnel-Type := "VLAN" Tunnel-Medium-Type := "IEEE-802" Tunnel-Private-Group-Id := "n" } Thoughts? G -----Original Message----- From: Gary Gatten Sent: Monday, August 24, 2009 10:34 AM To: 'FreeRadius users mailing list' Cc: 'Jason Alderfer' Subject: RE: Dynamic VLAN attribute in LDAP or AD? I'm assuming I can do roughly the same thing with NTLM_AUTH? I "have" to use NTLM_Auth for 8021x (right? - at least all docs say this), so if I don't HAVE to use LDAP all the better. TIA! Gary -----Original Message----- From: freeradius-users-bounces+ggatten=waddell.com@lists.freeradius.org [mailto:freeradius-users-bounces+ggatten=waddell.com@lists.freeradius.or g] On Behalf Of Jason Alderfer Sent: Tuesday, August 18, 2009 2:18 PM To: FreeRadius users mailing list Subject: Re: Dynamic VLAN attribute in LDAP or AD?
So, I'm trying to use 802.1x dynamic VLAN assignment. I have this working when I conf the "users" file. However, I don't want to create/maintain the users file for 2,000 users!
Is there an attribute in AD / LDAP I can use for the dynamic VLAN? Ideally I could do this at the "Group" level, such that when a user moves from one group to another their automagically assigned to the correct VLAN.
If you're using version 2.0.5 or higher you can do this with unlang as follows. This example sets the vlan based on the user's DN, but you should be able to modify it to look at your group membership attribute. Repeat for all relevant ldap groups. if (control:Ldap-UserDn =~ /ou=div,o=org/i) { update reply { Tunnel-Type := "VLAN" Tunnel-Medium-Type := "IEEE-802" Tunnel-Private-Group-Id := 9 } } - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>
So, by looking at this more carefully I'll have to do a bunch of if/else's or cases? What if for instance I have 500 departments/groups - 500 different vlans? I'll have to test each one?
I guess what I was hoping to do was something like:
Get attribute "n" for user y (where n = a value used for Tunnel-Private-Group-Id"
Thoughts?
Use ms-RADIUS-FramedIntefaceId from AD schema and map it in ldap.attrmap. IAS uses that for VLAN id. Ivan Kalik Kalik Informatika ISP
Gary Gatten wrote:
I'm assuming I can do roughly the same thing with NTLM_AUTH? I "have" to use NTLM_Auth for 8021x (right? - at least all docs say this),
No, they don't. They say that you need to use ntlm_auth for authentication in *certain* cases, when the user database is Active Directory.
so if I don't HAVE to use LDAP all the better.
If you don't have Active Directory, you can use anything you want as a database. Alan DeKok.
participants (6)
-
Alan Buxey -
Alan DeKok -
Gary Gatten -
Ivan Kalik -
Jason Alderfer -
Rokkhan