groupmembership and vlan assignment
Hello We have been using the groupmembership attribute in radius.conf to assign users to the appropriate vlans. Up until now we've done it based on the type of LDAP user they are (ie, staff, student, faculty, etc..): groupmembership_attribute = eduPersonPrimaryAffiliation, (where eduPersonPrimaryAffliation=staff, student, facult, etc..) Unfortunately, our student vlans have grown significantly large and we want to take measures to make them smaller. We have looked into using LDAP entitlement fields. There are however a few issues here: - The eduPersonEntitlement attribute is not unique. A user record can have multiple instances of this attribute for each different entitlement they have. - The eduPersonEntitlement attribute has a value that is not simply the name of a vlan. It is typically something like: eduPersonEntitlement: urn:mace:uni.ca:wireless?vlan=student1 So I'd need to parse the value as well to pull out the vlan name, in this case "student1". I'm unsure how to get around these two issues. Any suggestions are welcome. Thanks Matt mda@unb.ca
Nobody replied to my original post, and I got to thinking, would I be able to use wildcards in my users file to achieve this when looking for which Ldap-Group the user has been placed in? i.e. DEFAULT FreeRADIUS-Proxied-To == 127.0.0.1, Huntgroup-Name == UNBFWSS, unbldap-Ldap-Group =~ ".*staff1", Autz-Type := Ldap1, Auth-Type := Ldap1 Where unbldap-Ldap-Group gets set via groupmembership_attribute = eduPersonPrimaryAffiliation and eduPersonEntitlement: urn:mace:uni.ca:wireless?vlan=staff1 in LDAP Thanks Matt Ashfield mda@unb.ca From: freeradius-users-bounces+mda=unb.ca@lists.freeradius.org [mailto:freeradius-users-bounces+mda=unb.ca@lists.freeradius.org] On Behalf Of Matt Ashfield Sent: Wednesday, July 23, 2008 10:29 AM To: 'FreeRadius users mailing list' Subject: groupmembership and vlan assignment Hello We have been using the groupmembership attribute in radius.conf to assign users to the appropriate vlans. Up until now we've done it based on the type of LDAP user they are (ie, staff, student, faculty, etc..): groupmembership_attribute = eduPersonPrimaryAffiliation, (where eduPersonPrimaryAffliation=staff, student, facult, etc..) Unfortunately, our student vlans have grown significantly large and we want to take measures to make them smaller. We have looked into using LDAP entitlement fields. There are however a few issues here: - The eduPersonEntitlement attribute is not unique. A user record can have multiple instances of this attribute for each different entitlement they have. - The eduPersonEntitlement attribute has a value that is not simply the name of a vlan. It is typically something like: eduPersonEntitlement: urn:mace:uni.ca:wireless?vlan=student1 So I'd need to parse the value as well to pull out the vlan name, in this case "student1". I'm unsure how to get around these two issues. Any suggestions are welcome. Thanks Matt mda@unb.ca
That's what I was afraid of. Any suggestions to getting around this? Thanks Matt Ashfield mda@unb.ca -----Original Message----- From: Alan DeKok [mailto:aland@deployingradius.com] Sent: Monday, July 28, 2008 3:23 PM To: mda@unb.ca; FreeRadius users mailing list Subject: Re: groupmembership and vlan assignment Matt Ashfield wrote:
DEFAULT FreeRADIUS-Proxied-To == 127.0.0.1, Huntgroup-Name == UNBFWSS, unbldap-Ldap-Group =~ .*staff1, Autz-Type := Ldap1, Auth-Type := Ldap1
The LDAP Group checking does *equality* checking, not regular expression checking. Sorry. Alan DeKok.
Hmmm...welll I was hoping for another way to assign vlans based on ldap attributes, but I don't figure on rewriting rlm_ldap. Thanks Matt mda@unb.ca -----Original Message----- From: Alan DeKok [mailto:aland@deployingradius.com] Sent: Wednesday, July 30, 2008 3:49 PM To: mda@unb.ca; FreeRadius users mailing list Subject: Re: groupmembership and vlan assignment Matt Ashfield wrote:
That's what I was afraid of. Any suggestions to getting around this?
Edit the source code to rlm_ldap to implement regex checks. Alan DeKok.
Would it make more sense then to use a Perl program instead for the authorization and then have that program: - verify credentials against ldap. - do the regexp matching on the entitlement field? Thanks, Matt mda@unb.ca -----Original Message----- From: Alan DeKok [mailto:aland@deployingradius.com] Sent: Friday, August 01, 2008 8:27 AM To: mda@unb.ca; FreeRadius users mailing list Subject: Re: groupmembership and vlan assignment Matt Ashfield wrote:
Hmmm...welll I was hoping for another way to assign vlans based on ldap attributes, but I don't figure on rewriting rlm_ldap.
You don't have to rewrite the whole module. Just change 100 lines in one function. Alan DeKok.
Matt Ashfield wrote:
Would it make more sense then to use a Perl program instead for the authorization and then have that program: - verify credentials against ldap. - do the regexp matching on the entitlement field?
If it works. And *please* don't CC me on messages to the list. I *do* read the list. Doubling the amount of incoming email does nothing helpful. Alan DeKok.
participants (2)
-
Alan DeKok -
Matt Ashfield