Machine auth LDAP group checking
Hi All, I've just successfully configured machine authentication with PEAP. As a final step, I am trying to assign a specific VLAN ID in sites-enabled/default post-auth. The problem I am having is that when I try to use the attribute "ldap.host-LDAP-Group", the LDAP search does not run. If I use "LDAP-Group" the search runs, but the group is not found due to a difference in the filter. I've configured a second instance of the ldap module like so: ldap ldap.host { ... } Then in sites-enabled/default: post-auth { ldap #uncommented if (ldap.host-LDAP-Group == "uw-WiFi-Managed") { update reply { Aruba-User-Vlan := 1025 } } I can see that ldap.host-LDAP-Group is created when the server starts, so I know I'm checking the right attribute. Examples: Using ldap.host-LDAP-Group (9) post-auth { (9) update { (9) No attributes updated (9) } # update = noop (9) [ldap.host] = noop (9) [exec] = noop (9) policy remove_reply_message_if_eap { (9) if (&reply:EAP-Message && &reply:Reply-Message) { (9) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (9) else { (9) [noop] = noop (9) } # else = noop (9) } # policy remove_reply_message_if_eap = noop (9) if (&Realm == "uwaterloo.ca" ) { (9) if (&Realm == "uwaterloo.ca" ) -> FALSE (9) if (&Realm == "host") { (9) if (&Realm == "host") -> TRUE (9) if (&Realm == "host") { (9) if (ldap.host-LDAP-Group == "uw-WiFi-Managed") { (9) if (ldap.host-LDAP-Group == "uw-WiFi-Managed") -> FALSE (9) } # if (&Realm == "host") = noop (9) } # post-auth = noop (9) Login OK: [host/machine1 Using LDAP-Group (9) post-auth { (9) update { (9) No attributes updated (9) } # update = noop (9) [ldap.host] = noop (9) [exec] = noop (9) policy remove_reply_message_if_eap { (9) if (&reply:EAP-Message && &reply:Reply-Message) { (9) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (9) else { (9) [noop] = noop (9) } # else = noop (9) } # policy remove_reply_message_if_eap = noop (9) if (&Realm == "uwaterloo.ca" ) { (9) if (&Realm == "uwaterloo.ca" ) -> FALSE (9) if (&Realm == "host") { (9) if (&Realm == "host") -> TRUE (9) if (&Realm == "host") { (9) if (LDAP-Group == "uw-WiFi-Managed") { (9) Searching for user in group "uw-WiFi-Managed" rlm_ldap (ldap): Reserved connection (0) (9) EXPAND (samaccountname=%{%{Stripped-User-Name}:-%{User-Name}}) (9) --> (samaccountname=machine1) (9) Performing search in "OU=People,dc=domain,dc=uwaterloo,dc=ca" with filter "(samaccountname=machine1)", scope "sub" (9) Waiting for search result... (9) Search returned no results rlm_ldap (ldap): Released connection (0) (9) if (LDAP-Group == "uw-WiFi-Managed") -> FALSE (9) } # if (&Realm == "host") = noop (9) } # post-auth = noop (9) Login OK: [host/machine1 -- Dave Aldwinckle Network Services Information Systems & Technology University of Waterloo (519)-888-4567, x41145
Hi Alan, That didn't seem to do the trick. including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default /etc/raddb/sites-enabled/default[852]: Parse error in condition /etc/raddb/sites-enabled/default[852]: (&ldap.host-LDAP-Group == "uw-WiFi-Managed") /etc/raddb/sites-enabled/default[852]: ^ Invalid request qualifier Errors reading or parsing /etc/raddb/radiusd.conf $ radiusd -v radiusd: FreeRADIUS Version 3.0.10, for host x86_64-redhat-linux-gnu, built on Oct 5 2015 at 16:30:01 On 16-07-14 04:16 PM, Alan DeKok wrote:
On Jul 14, 2016, at 12:20 PM, Dave Aldwinckle <daldwinc@uwaterloo.ca> wrote:
(9) if (ldap.host-LDAP-Group == "uw-WiFi-Managed") { (9) if (ldap.host-LDAP-Group == "uw-WiFi-Managed") -> FALSE Use:
if (&ldap.host-LDAP-Group == "uw-WiFi-Managed")
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Mon, Jul 18, 2016 at 07:23:43AM -0400, Dave Aldwinckle wrote:
including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default /etc/raddb/sites-enabled/default[852]: Parse error in condition /etc/raddb/sites-enabled/default[852]: (&ldap.host-LDAP-Group == "uw-WiFi-Managed") /etc/raddb/sites-enabled/default[852]: ^ Invalid request qualifier Errors reading or parsing /etc/raddb/radiusd.conf
My suspicion: try without the "." in the attribute name. It's used for other things so personally I'd expect it may cause trouble. Matthew
On Jul 14, 2016, at 12:20 PM, Dave Aldwinckle <daldwinc@uwaterloo.ca> wrote:
(9) if (ldap.host-LDAP-Group == "uw-WiFi-Managed") { (9) if (ldap.host-LDAP-Group == "uw-WiFi-Managed") -> FALSE Use:
if (&ldap.host-LDAP-Group == "uw-WiFi-Managed")
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 16-07-14 04:16 PM, Alan DeKok wrote: - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Matthew Newton, Ph.D. <mcn4@leicester.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
Hi Matthew, I replaced the dot with a hyphen and the search ran! Thanks for the suggestions. Dave On 16-07-18 07:34 AM, Matthew Newton wrote:
On Mon, Jul 18, 2016 at 07:23:43AM -0400, Dave Aldwinckle wrote:
including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default /etc/raddb/sites-enabled/default[852]: Parse error in condition /etc/raddb/sites-enabled/default[852]: (&ldap.host-LDAP-Group == "uw-WiFi-Managed") /etc/raddb/sites-enabled/default[852]: ^ Invalid request qualifier Errors reading or parsing /etc/raddb/radiusd.conf My suspicion: try without the "." in the attribute name. It's used for other things so personally I'd expect it may cause trouble.
Matthew
On Jul 14, 2016, at 12:20 PM, Dave Aldwinckle <daldwinc@uwaterloo.ca> wrote:
(9) if (ldap.host-LDAP-Group == "uw-WiFi-Managed") { (9) if (ldap.host-LDAP-Group == "uw-WiFi-Managed") -> FALSE Use:
if (&ldap.host-LDAP-Group == "uw-WiFi-Managed")
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 16-07-14 04:16 PM, Alan DeKok wrote: - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (3)
-
Alan DeKok -
Dave Aldwinckle -
Matthew Newton