Hello, System version: freeradius-server-3.0.21 I follow this article“ https://wiki.freeradius.org/guide/Active-Directory-direct-via-winbind ”Guide and verify the ad domain user successfully; Now I want to return different VLAN IDs for different domain user groups. Can I do this? Are there any related reference articles? Looking forward to your professional guidance. Best regards
i am assuming you are trying to have some additional attributes in the reply messages. you can refer to the integration for "dynamic VLAN assignment" feature of some network equipment. first, your radius server should support the attributes. after that, find a way to append the attribute with the right value you want into the reply message. this can be done by pre-define the values in the AD server, or append into the message with some customization in the radius. On Tue, 13 Sept 2022 at 15:23, 网络时代 via Freeradius-Users < freeradius-users@lists.freeradius.org> wrote:
Hello,
System version: freeradius-server-3.0.21 I follow this article“ https://wiki.freeradius.org/guide/Active-Directory-direct-via-winbind ”Guide and verify the ad domain user successfully; Now I want to return different VLAN IDs for different domain user groups. Can I do this? Are there any related reference articles? Looking forward to your professional guidance.
Best regards - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Sep 13, 2022, at 3:22 AM, 网络时代 via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
System version: freeradius-server-3.0.21
I'd suggest upgrading to 3.2.0.
I follow this article“ https://wiki.freeradius.org/guide/Active-Directory-direct-via-winbind ”Guide and verify the ad domain user successfully; Now I want to return different VLAN IDs for different domain user groups. Can I do this? Are there any related reference articles?
There are no articles which document every possible scenario. Instead, there is documentation which describes how the server works. It's up to you to put the pieces together. If you want to assign VLAN ID based on groups, you should configure the "ldap" module, and do group checking there. Then, do: if (LDAP-Group == "group1") { // send VLAN 1 reply } elsif (LDAP-Group == "group2") { // send VLAN 2 reply etc. Alan DeKok.
which means injecting the attribute into the reply message during the authorization. On Tue, 13 Sept 2022 at 22:29, Alan DeKok <aland@deployingradius.com> wrote:
On Sep 13, 2022, at 3:22 AM, 网络时代 via Freeradius-Users < freeradius-users@lists.freeradius.org> wrote:
System version: freeradius-server-3.0.21
I'd suggest upgrading to 3.2.0.
I follow this article“ https://wiki.freeradius.org/guide/Active-Directory-direct-via-winbind ”Guide and verify the ad domain user successfully; Now I want to return different VLAN IDs for different domain user groups. Can I do this? Are there any related reference articles?
There are no articles which document every possible scenario. Instead, there is documentation which describes how the server works. It's up to you to put the pieces together.
If you want to assign VLAN ID based on groups, you should configure the "ldap" module, and do group checking there. Then, do:
if (LDAP-Group == "group1") { // send VLAN 1 reply } elsif (LDAP-Group == "group2") { // send VLAN 2 reply
etc.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (3)
-
Alan DeKok -
Bill Yuan -
网络时代