Returning Filter-Id based on LDAP group
Hello list, I'd like to set the Filter-Id in the response based on an LDAP group. authorize { .... if ( Ldap-Group =~ /CN=group1,ou=groups,dc=company,dc=com/ ) { update control { Tmp-String-1 := "group1" } .... } post-auth { .... update reply { Filter-Id := "%{control:Tmp-String-1}" } } This works like a charme! As I got a lot of groups, I'd like to do some pattern matching... if ( Ldap-Group =~ /CN=(xyz),ou=groups,dc=company,dc=com/ ) { update control { Tmp-String-1 := "%{1}" } ... but it seems that the ldap_groupcmp does not support pattern matching? Am I right or does anybody has another idea? Thanks a lot and kind regards Cornelius
On 06/02/12 15:53, Cornelius Kölbel wrote:
... but it seems that the ldap_groupcmp does not support pattern matching? Am I right or does anybody has another idea?
Ldap-Group isn't a "real" attribute. It is a virtual attribute, that triggers a search in the directory when you compare to it. So you can't do this.
Hi Phil, I thought so. But thanks a lot for clarifying this. Kind regards Cornelius Am 06.02.2012 17:21, schrieb Phil Mayers:
On 06/02/12 15:53, Cornelius Kölbel wrote:
... but it seems that the ldap_groupcmp does not support pattern matching? Am I right or does anybody has another idea?
Ldap-Group isn't a "real" attribute. It is a virtual attribute, that triggers a search in the directory when you compare to it.
So you can't do this. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (2)
-
Cornelius Kölbel -
Phil Mayers