I have RADIUS running with multiple realms and multiple LDAP back ends that stores all my user attributes. I am trying to apply different user profiles to different groups. What I did was setup the profile in the USERS file, add the group attributes to the ldap config file, and on the user's LDAP account I added the attribute radiusGroupName with the value "residential_profile", but I can't seem to get it to work correctly. It doesn't seem to query the correct backend. I am sure that I have something wrong but I am not sure what I looked at rlm_ldap and searched the archive list but haven't been able to find anything any help would be appreciated. This is what my configuration files look like; USERS DEFAULT Ldap-Group == residential_profile Service-Type = Framed-User, Framed-Protocol = PPP, Cisco-AVPair += "ip:inacl#100=permit tcp any x.x.x.x 0.0.0.15 eq 25", Cisco-AVPair += "ip:inacl#200=deny tcp any any eq 25", Cisco-AVPair += "ip:inacl#300=permit ip any any", Fall-Through = No ldap ldap2.REALM-2.ca { basedn = "ou=radius,o=REALM-2.ca,dc=container,dc=ca" filter = "(&(uid=%{%{Stripped-User-Name}:-%{User-Name}})(objectclass=posixAccount)(cn=true))" ldap ldap1.REALM-1.ca { basedn = "ou=radius,o=REALM-1.ca,dc=container,dc=ca" filter = "(&(uid=%{%{Stripped-User-Name}:-%{User-Name}})(objectclass=posixAccount)(cn=true))" groupname_attribute = cn groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn})))" groupmembership_attribute = radiusGroupName Output from radius -X [files] users: Matched entry DEFAULT at line 214 [ldap2.REALM-2.ca] Entering ldap_groupcmp() [files] expand: ou=radius,o=REALM-2.ca,dc=container,dc=ca -> ou=radius,o= REALM-2ca,dc= container,dc=ca [files] expand: %{Stripped-User-Name} -> 112boy [files] expand: (&(uid=%{%{Stripped-User-Name}:-%{User-Name}})(objectclass=posixAccount)(cn=true)) -> (&(uid=112boy)(objectclass=posixAccount)(cn=true)) [ldap2. REALM-2.ca] ldap_get_conn: Checking Id: 0 [ldap2. REALM-2.ca] ldap_get_conn: Got Id: 0 [ldap2. REALM-2.ca] attempting LDAP reconnection [ldap2. REALM-2.ca] Bind was successful [ldap2. REALM-2.ca] performing search in ou=radius,o= REALM-2.ca,dc= container,dc=ca, with filter (&(uid=112boy)(objectclass=posixAccount)(cn=true)) [ldap2. REALM-2.ca] object not found rlm_ldap::ldap_groupcmp: search failed [ldap2. REALM-2.ca] ldap_release_conn: Release Id: 0 Thanks, Chris
Chris Taylor wrote:
I have RADIUS running with multiple realms and multiple LDAP back ends that stores all my user attributes. I am trying to apply different user profiles to different groups. What I did was setup the profile in the USERS file, add the group attributes to the ldap config file, and on the user’s LDAP account I added the attribute radiusGroupName with the value “residential_profile”, but I can’t seem to get it to work correctly.
The debug output is pretty clear. It does an LDAP search, and the object isn't found. Make sure that (a) the object is in LDAP, and (b) you've configured FreeRADIUS to do the right LDAP search.
It doesn’t seem to query the correct backend.
For backend-specific queries, prefix the LDAP-Group with the backend name:
ldap ldap2.REALM-2.ca { basedn = "ou=radius,o=REALM-2.ca,dc=container,dc=ca"
To query this backend, use "ldap2.REALM-2.ca-LDAP-Group == ..." Alan DeKok.
I have RADIUS running with multiple realms and multiple LDAP back ends that stores all my user attributes. I am trying to apply different user profiles to different groups. What I did was setup the profile in the USERS file, add the group attributes to the ldap config file, and on the user’s LDAP account I added the attribute radiusGroupName with the value “residential_profile”, but I can’t seem to get it to work correctly.
The debug output is pretty clear. It does an LDAP search, and the object isn't found. Make sure that (a) the object is in LDAP, and (b) you've configured FreeRADIUS to do the right LDAP search.
It doesn’t seem to query the correct backend.
For backend-specific queries, prefix the LDAP-Group with the backend name:
ldap ldap2.REALM-2.ca { basedn = "ou=radius,o=REALM-2.ca,dc=container,dc=ca"
To query this backend, use "ldap2.REALM-2.ca-LDAP-Group == ..." Alan DeKok. Alan I tried the setup that you suggested but it just threw an error at me. I added this to the users file DEFAULT ldap1.REALM-2.ca-Ldap-Group == residential_profile But I get this error when I fire up radius -X /etc/raddb/users[222]: Parse error (check) for entry DEFAULT: expecting operator Errors reading /etc/raddb/users Thanks, Chris -----Original Message----- From: freeradius-users-bounces+chris.taylor=corp.eastlink.ca@lists.freeradius.org [mailto:freeradius-users-bounces+chris.taylor=corp.eastlink.ca@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Monday, February 04, 2013 3:51 PM To: FreeRadius users mailing list Subject: Re: LDAP groups and profiles Chris Taylor wrote:
I have RADIUS running with multiple realms and multiple LDAP back ends that stores all my user attributes. I am trying to apply different user profiles to different groups. What I did was setup the profile in the USERS file, add the group attributes to the ldap config file, and on the user’s LDAP account I added the attribute radiusGroupName with the value “residential_profile”, but I can’t seem to get it to work correctly.
The debug output is pretty clear. It does an LDAP search, and the object isn't found. Make sure that (a) the object is in LDAP, and (b) you've configured FreeRADIUS to do the right LDAP search.
It doesn’t seem to query the correct backend.
For backend-specific queries, prefix the LDAP-Group with the backend name:
ldap ldap2.REALM-2.ca { basedn = "ou=radius,o=REALM-2.ca,dc=container,dc=ca"
To query this backend, use "ldap2.REALM-2.ca-LDAP-Group == ..." Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 05/02/13 15:50, Chris Taylor wrote:
I added this to the users file
DEFAULT ldap1.REALM-2.ca-Ldap-Group == residential_profile
But I get this error when I fire up radius -X
/etc/raddb/users[222]: Parse error (check) for entry DEFAULT: expecting operator Errors reading /etc/raddb/users
Wild guess, but you might try a simpler module name e.g. "ldap2" instead of "ldap2.some.dots-and.hyphens".
I added this to the users file
DEFAULT ldap1.REALM-2.ca-Ldap-Group == residential_profile
But I get this error when I fire up radius -X
/etc/raddb/users[222]: Parse error (check) for entry DEFAULT: expecting operator Errors reading /etc/raddb/users
Wild guess, but you might try a simpler module name e.g. "ldap2" instead of "ldap2.some.dots-and.hyphens". Phil I gave that a try but ended up with the same result. Chris Chris Taylor System Administrator Network Operations Eastlink Chris.Taylor@corp.eastlink.ca T: 519.773.1287 -----Original Message----- From: freeradius-users-bounces+chris.taylor=corp.eastlink.ca@lists.freeradius.org [mailto:freeradius-users-bounces+chris.taylor=corp.eastlink.ca@lists.freeradius.org] On Behalf Of Phil Mayers Sent: Tuesday, February 05, 2013 11:23 AM To: freeradius-users@lists.freeradius.org Subject: Re: LDAP groups and profiles On 05/02/13 15:50, Chris Taylor wrote:
I added this to the users file
DEFAULT ldap1.REALM-2.ca-Ldap-Group == residential_profile
But I get this error when I fire up radius -X
/etc/raddb/users[222]: Parse error (check) for entry DEFAULT: expecting operator Errors reading /etc/raddb/users
Wild guess, but you might try a simpler module name e.g. "ldap2" instead of "ldap2.some.dots-and.hyphens". - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
I added this to the users file
DEFAULT ldap1.REALM-2.ca-Ldap-Group == residential_profile
But I get this error when I fire up radius -X
/etc/raddb/users[222]: Parse error (check) for entry DEFAULT: expecting operator Errors reading /etc/raddb/users
Wild guess, but you might try a simpler module name e.g. "ldap2" instead of "ldap2.some.dots-and.hyphens". Phil I gave that a try but ended up with the same result. Chris I was able to get this working by adding that ldap instance to the instantiate section of radius.conf. I can do a query successfully from LDAP now and pull the group info, but during the query I am seeing first a failed query then a successful query how could I go about fixing this? I believe it's the groupmembership_filter settings but I left them to the default values which seems to be the consensus on the mailing list. ############ radius -X output ######### [REALM1] Entering ldap_groupcmp() [files] expand: ou=radius,o=realm1.ca,dc=company,dc=ca -> ou=radius,o=realm1.ca,dc=company,dc=ca [files] expand: (|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=))(&(objectClass=GroupOfUniqueNames)(uniquemember=))) [REALM1] ldap_get_conn: Checking Id: 0 [REALM1] ldap_get_conn: Got Id: 0 [REALM1] performing search in ou=radius,o=realm1.ca,dc=company,dc=ca, with filter (&(cn=residential_profile)(|(&(objectClass=GroupOfNames)(member=))(&(objectClass=GroupOfUniqueNames)(uniquemember=)))) [REALM1] object not found [REALM1] ldap_release_conn: Release Id: 0 [REALM1] ldap_get_conn: Checking Id: 0 [REALM1] ldap_get_conn: Got Id: 0 [REALM1] performing search in uid=112boy,ou=radius,o=realm1.ca,dc=company,dc=ca, with filter (objectclass=*) rlm_ldap::ldap_groupcmp: User found in group residential_profile [REALM1] ldap_release_conn: Release Id: 0 ################################### ### Group section of LDAP module ##### groupname_attribute = cn groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" groupmembership_attribute = radiusGroupName ######################################### ##### LDAP entry for an account I am querying against ###### dn: uid=112boy,ou=radius,o=realm1.ca,dc=company,dc=ca uid: 112boy userPassword: XXXX objectClass:top objectClass: posixAccount objectClass: radiusProfile uidNumber: 1100 gidNumber:1100 radiusSimultaneousUse: 099 radiusAuthType: PAP homeDirectory: // radiusGroupName: residential_profile cn: TRUE ########################################### I do get a successful query I would just like to figure out how to get it to resolve on the first attempt. Thanks, Chris -----Original Message----- From: freeradius-users-bounces+chris.taylor=corp.eastlink.ca@lists.freeradius.org [mailto:freeradius-users-bounces+chris.taylor=corp.eastlink.ca@lists.freeradius.org] On Behalf Of Phil Mayers Sent: Tuesday, February 05, 2013 11:23 AM To: freeradius-users@lists.freeradius.org Subject: Re: LDAP groups and profiles On 05/02/13 15:50, Chris Taylor wrote:
I added this to the users file
DEFAULT ldap1.REALM-2.ca-Ldap-Group == residential_profile
But I get this error when I fire up radius -X
/etc/raddb/users[222]: Parse error (check) for entry DEFAULT: expecting operator Errors reading /etc/raddb/users
Wild guess, but you might try a simpler module name e.g. "ldap2" instead of "ldap2.some.dots-and.hyphens". - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (3)
-
Alan DeKok -
Chris Taylor -
Phil Mayers