Hi folk, I am using attribute filter on my radius proxy server to filter attributes (Tunnel-Type, Tunnel-Medium-Type, Trapeze-VLAN-Name=Tunnel-Private-Group-Id) received from the home server for multiple realms (authentification and authorisation attributes are stored in ldap database). Let's say for realm "dr4.cnrs.fr" I would like that only VLAN1 and VLAN2 are permitted. So I activated rlm_attr_filter and my attrs file contain this section: Service-Type == Login-User, Proxy-State =* ANY, . . . Tunnel-Type == VLAN, Tunnel-Medium-Type == IEEE-802, Trapeze-VLAN-Name == VLAN1, Trapeze-VLAN-Name == VLAN2, Tunnel-Private-Group-Id == VLAN1, Tunnel-Private-Group-Id == VLAN2, But It doesn't work unless I set those attributes to * ANY (Trapeze-VLAN-Name =* ANY, Tunnel-Private-Group-Id = * ANY, ...) Thanks for help and clues. -- Mustapha BOUIKHIF Service Systèmes d'Information CNRS - DR4 tel: +33 1 69 82 33 97 fax: +33 1 69 82 33 39
tnt@kalik.net a écrit :
Let's say for realm "dr4.cnrs.fr" I would like that only VLAN1 and VLAN2 are permitted.
Use unlang and -=.
excuse me Ivan, I don't understand. can you explain more... thanks.
Ivan Kalik Kalik Informatika ISP
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Mustapha BOUIKHIF Service Systèmes d'Information CNRS - DR4 tel: +33 1 69 82 33 97 fax: +33 1 69 82 33 39
Let's say for realm "dr4.cnrs.fr" I would like that only VLAN1 and VLAN2 are permitted.
Use unlang and -=.
excuse me Ivan, I don't understand. can you explain more... thanks.
You say attr.filter is not working (and provide no debug) for you. Use unlang instead. Read man unlang and see what is -= for. Ivan Kalik Kalik Informatika ISP
You say attr.filter is not working (and provide no debug) for you. Use unlang instead. Read man unlang and see what is -= for.
Ok. But in which section of radiusd.conf or sites-available/file should I use unlang ? in post-proxy section ? Shall i use switch again to the corresponding realms ? man unlang says: -= Remove all matching attributes from the list I don't want to remove attributes, but to filter some attributes (Tunnel-Private-Group-id) which must have 2 possible values: VLAN1 or VLAN2 for a given realm. -- Mustapha BOUIKHIF Service Systèmes d'Information CNRS - DR4 tel: +33 1 69 82 33 97 fax: +33 1 69 82 33 39
Ok. But in which section of radiusd.conf or sites-available/file should I use unlang ? in post-proxy section ?
Yes, just like attribute filter.
Shall i use switch again to the corresponding realms ? man unlang says: -= Remove all matching attributes from the list I don't want to remove attributes, but to filter some attributes (Tunnel-Private-Group-id) which must have 2 possible values: VLAN1 or VLAN2 for a given realm.
Can you first post the debug and explain what did you expect to happen but didn't (or what you didn't expect to happen but did). If it is multiple values for same attribute over multiple realms you are better off with attribute filter. Ivan Kalik Kalik informatika ISP
participants (2)
-
Mustapha Bouikhif -
tnt＠kalik.net