two user authentication groups for one AS
Hi There is one VPN server that I want to authenticate some of its users with ldap-1 and others with ldap-2. how should I differ them? I defined: DEFAULT Client-IP-Address == 192.168.200.21, Auth-Type := ldap-1, Autz-Type := Vpn DEFAULT Client-IP-Address == 192.168.200.21, Auth-Type := ldap-2, Autz-Type := Vpn but it only sees first line.
Eric wrote:
Hi There is one VPN server that I want to authenticate some of its users with ldap-1 and others with ldap-2. how should I differ them?
What is different about the packets for users in ldap-1, and users in ldap-2?
I defined: DEFAULT Client-IP-Address == 192.168.200.21, Auth-Type := ldap-1, Autz-Type := Vpn DEFAULT Client-IP-Address == 192.168.200.21, Auth-Type := ldap-2, Autz-Type := Vpn
but it only sees first line.
Uh... see "man users". Yes, it only sees the first line, because the first line matches. Alan DeKok.
access-attr is differ for two group users.
Hi There is one VPN server that I want to authenticate some of its users with ldap-1 and others with ldap-2. how should I differ them?
What is different about the packets for users in ldap-1, and users in ldap-2?
I defined: DEFAULT Client-IP-Address == 192.168.200.21, Auth-Type := ldap-1, Autz-Type := Vpn DEFAULT Client-IP-Address == 192.168.200.21, Auth-Type := ldap-2, Autz-Type := Vpn
but it only sees first line.
Uh... see "man users". Yes, it only sees the first line, because the first line matches.
Excuse me. The packets from vpn server to ldap-1 are the same as ldap-2. I want only in freeradius.org have ldap ldap-1 and ldap-2 for theses users.
Eric wrote:
Excuse me. The packets from vpn server to ldap-1 are the same as ldap-2.
OK...
I want only in freeradius.org have ldap ldap-1 and ldap-2 for theses users.
How will you tell them apart? Think of how you will get "user 1" to use "ldap-1", and "user 2" to use "ldap-2". FreeRADIUS isn't magic. It cannot magically determine which user should go to which ldap server. *You* need to figure out how to make that decision, and then write the configuration for FreeRADIUS to use. Alan DeKok.
My users differ in ldap attributes. I want session-timeout of some users to be the value of counter and for others the session-timeout that I define in freeradius for them. How should I distinct them?
Excuse me. The packets from vpn server to ldap-1 are the same as ldap-2.
OK...
I want only in freeradius.org have ldap ldap-1 and ldap-2 for theses users.
How will you tell them apart? Think of how you will get "user 1" to use "ldap-1", and "user 2" to use "ldap-2". FreeRADIUS isn't magic. It cannot magically determine which user should go to which ldap server. *You* need to figure out how to make that decision, and then write the configuration for FreeRADIUS to use.
On Sat, Jan 2, 2010 at 1:59 PM, Eric <bbahar3@gmail.com> wrote:
My users differ in ldap attributes. I want session-timeout of some users to be the value of counter and for others the session-timeout that I define in freeradius for them. How should I distinct them?
Excuse me.
The packets from vpn server to ldap-1 are the same as ldap-2.
OK...
I want only in freeradius.org have ldap ldap-1 and ldap-2 for theses users.
How will you tell them apart?
Think of how you will get "user 1" to use "ldap-1", and "user 2" to use "ldap-2".
FreeRADIUS isn't magic. It cannot magically determine which user
should go to which ldap server. *You* need to figure out how to make that decision, and then write the configuration for FreeRADIUS to use.
My users differ in ldap attributes. I want session-timeout of some users to be the value of counter and for others the session-timeout that I define in freeradius for them. How should I distinct them?
How will you tell them apart?
Think of how you will get "user 1" to use "ldap-1", and "user 2" to use "ldap-2".
FreeRADIUS isn't magic. It cannot magically determine which user should go to which ldap server. *You* need to figure out how to make that decision, and then write the configuration for FreeRADIUS to use.
You are asking us how to organize your users??? Well, *you* are the one who is supposed to think of that. Put them in different groups or something. Ivan Kalik
participants (3)
-
Alan DeKok -
Eric -
tnt＠kalik.net