Two different ldap module instances
Hello, I need two different ldap module instances in my freeradius (3.0.10) server, so I have one with "ldap" name and the other named "ldap-eduroam". In my eduroam site configuration I have: authorize { preprocess eduroam_inner_log suffix eap ldap-eduroam files_eduroam_inner mschap pap } And in its authorized file I have entries like: DEFAULT ..., Ldap-Group == 1001 User-Name = "%{User-Name}", Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = <VLAN tag>, Fall-Through = No My problem is that this Ldap-Group is using "ldap" module instead of "ldap-eduroam" one. Why? Is there any way to force it to use ldap-eduroam? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información y las Comunicaciones Aplicadas (ATICA) http://www.um.es/atica Tfo: 868887590 Fax: 868888337
Hi, isolate policies using virtual servers and use unlang to define the return attributes rather than the users file. (why the two ldap instances? different people allowed to use eduroam?) alan
El 07/03/16 a las 12:35, A.L.M.Buxey@lboro.ac.uk escribió:
Hi,
isolate policies using virtual servers and use unlang to define the return attributes rather than the users file.
I have not use policies yet in any configuration. I'm using the users file to configure different vlans in eduroam depending on the group of the user and the AP he/she is connected to. Could I achive this with policies? Do you have any pointer to documentation?
(why the two ldap instances? different people allowed to use eduroam?)
No. I'm using different ldap instances in different virtual servers, because I have different applications authenticating with my radius server. These applications use a ldap instance with different user filter than eduroam. This is the way we are using, but if I could configure different filters using the same ldap instance, I'm ready to change it.
alan
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información y las Comunicaciones Aplicadas (ATICA) http://www.um.es/atica Tfo: 868887590 Fax: 868888337
On Mon, Mar 07, 2016 at 12:28:20PM +0100, Angel L. Mateo wrote:
I need two different ldap module instances in my freeradius (3.0.10) server, so I have one with "ldap" name and the other named "ldap-eduroam". ...
My problem is that this Ldap-Group is using "ldap" module instead of "ldap-eduroam" one.
Why? Is there any way to force it to use ldap-eduroam?
IIRC you should be able to use "ldap-Ldap-Group" and "ldap-eduroam-Ldap-Group". Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
On Mon, Mar 07, 2016 at 12:22:43PM +0000, Matthew Newton wrote:
On Mon, Mar 07, 2016 at 12:28:20PM +0100, Angel L. Mateo wrote:
I need two different ldap module instances in my freeradius (3.0.10) server, so I have one with "ldap" name and the other named "ldap-eduroam". ...
My problem is that this Ldap-Group is using "ldap" module instead of "ldap-eduroam" one.
Why? Is there any way to force it to use ldap-eduroam?
IIRC you should be able to use "ldap-Ldap-Group" and "ldap-eduroam-Ldap-Group".
https://github.com/FreeRADIUS/freeradius-server/blob/v3.1.x/raddb/mods-avail... Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
participants (3)
-
A.L.M.Buxey＠lboro.ac.uk -
Angel L. Mateo -
Matthew Newton