Hi, We are defining custom VSA's for our company. We have ldap configured in freeradius which returns back the VSA's. I defined custom VSA in $freeradius/share/freeradius/dictionary.abc ATTRIBUTE rEntitlements 113 string entitlements is multivalue attribute (vARRAY) in LDAP. In the ldap.attrmap it is defined as replyItem rEntitlements entitlements == So after the successful authentication, I am getting the rEntitlements back as Sending Access-Accept of id 50 to 69.74.69.31 port 1814 Session-Timeout = 7200 rEntitlements == "ADMALL" rEntitlements == "STORE" rEntitlements == "WEPG" rEntitlements == "WADM" rEntitlements == "SDNLD" rEntitlements == "WIFILOC1" BUT I am looking for ONLY WIFILOC1 for the NAS. NAS will redirect if WIFILOC1 exists. Can I do regex in the rEntitlements so freeradius ONLY returns rEntitlements = "WIFILOC1" and ignore the rest? Please let me know. Thanks in advance.
+= http://wiki.freeradius.org/Operators Ivan Kalik Kalik Informatika ISP Dana 8/10/2008, "Eric Martell" <workoutexcite@yahoo.com> piše:
Hi, We are defining custom VSA's for our company. We have ldap configured in freeradius which returns back the VSA's.
I defined custom VSA in $freeradius/share/freeradius/dictionary.abc ATTRIBUTE rEntitlements 113 string
entitlements is multivalue attribute (vARRAY) in LDAP.
In the ldap.attrmap it is defined as
replyItem rEntitlements entitlements ==
So after the successful authentication, I am getting the rEntitlements back as
Sending Access-Accept of id 50 to 69.74.69.31 port 1814 Session-Timeout = 7200 rEntitlements == "ADMALL" rEntitlements == "STORE" rEntitlements == "WEPG" rEntitlements == "WADM" rEntitlements == "SDNLD" rEntitlements == "WIFILOC1"
BUT I am looking for ONLY WIFILOC1 for the NAS. NAS will redirect if WIFILOC1 exists.
Can I do regex in the rEntitlements so freeradius ONLY returns rEntitlements = "WIFILOC1" and ignore the rest?
Please let me know. Thanks in advance.
Hi Ivan, Thanks for the reply. After changing the operator += I am still seeing all the VARRAY in the reply. It should reply back only Sending Access-Accept of id 65 to 216.121.193.1 port 49266 rEntitlements += "WIFILOC1" rAttribute1 = "11111" rCidx = "11111" and not as it is happening now.... auth: type "LDAP" +- entering group LDAP rlm_ldap: - authenticate rlm_ldap: login attempt by "etest300" with password "test123" rlm_ldap: user DN: uid=test1212121 rlm_ldap: (re)connect to xxxxxxxxx:389, authentication 1 rlm_ldap: bind as uid=test1212121/test123 to xxxxxxx:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user etest300 authenticated succesfully ++[ldap1] returns ok +- entering group post-auth ++[exec] returns noop Sending Access-Accept of id 65 to 216.2.193.1 port 49266 rEntitlements += "webhosting" rEntitlements += "2UP15DWN" rEntitlements += "5UP30DWN" rEntitlements += "WIFILOC1" rAttribute1 = "11111" rCidx = "11111" Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 65 with timestamp +1 Ready to process requests. Please let me know. Thanks so much in advance. Regards. --- On Wed, 10/8/08, tnt@kalik.net <tnt@kalik.net> wrote: From: tnt@kalik.net <tnt@kalik.net> Subject: Re: Radius reply multivalue VSA question. To: freeradius-users@lists.freeradius.org Date: Wednesday, October 8, 2008, 7:18 PM += http://wiki.freeradius.org/Operators Ivan Kalik Kalik Informatika ISP Dana 8/10/2008, "Eric Martell" <workoutexcite@yahoo.com> piše:
Hi, We are defining custom VSA's for our company. We have ldap configured in freeradius which returns back the VSA's.
I defined custom VSA in $freeradius/share/freeradius/dictionary.abc ATTRIBUTE rEntitlements 113 string
entitlements is multivalue attribute (vARRAY) in LDAP.
In the ldap.attrmap it is defined as
replyItem rEntitlements entitlements ==
So after the successful authentication, I am getting the rEntitlements back as
Sending Access-Accept of id 50 to 69.74.69.31 port 1814 Session-Timeout = 7200 rEntitlements == "ADMALL" rEntitlements == "STORE" rEntitlements == "WEPG" rEntitlements == "WADM" rEntitlements == "SDNLD" rEntitlements == "WIFILOC1"
BUT I am looking for ONLY WIFILOC1 for the NAS. NAS will redirect if WIFILOC1 exists.
Can I do regex in the rEntitlements so freeradius ONLY returns rEntitlements = "WIFILOC1" and ignore the rest?
Please let me know. Thanks in advance.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Thanks for the reply. After changing the operator += I am still seeing all the VARRAY in the reply. It should reply back only Sending Access-Accept of id 65 to 216.121.193.1 port 49266
rEntitlements += "WIFILOC1"
rAttribute1 = "11111"
rCidx = "11111"
and not as it is happening now....
So why did you put those other rEntitlements into the user profile. If they are not the same thing they shold have different attribute names. Ivan Kalik Kalik Informatika ISP
Hi Ivan, I agree with you. But I am reading those attributes from LDAP. In LDAP "entitlements" attribute is defined as Multivalue (array). I can't not change the existing LDAP structure. I am mapping "entitlements" attribute from LDAP with the radius attribute rEntitlements in the ldap.attrmap replyItem rEntitlements entitlements += which is good so far. But I don't need entire array from LDAP as reply just looking for WIFILOC1 and send that as reply. Please let me know if you need more information. Thanks so much. Regards. --- On Thu, 10/9/08, tnt@kalik.net <tnt@kalik.net> wrote: From: tnt@kalik.net <tnt@kalik.net> Subject: Re: Radius reply multivalue VSA question. To: freeradius-users@lists.freeradius.org Date: Thursday, October 9, 2008, 11:40 AM
Thanks for the reply. After changing the operator += I am still seeing all the VARRAY in the reply. It should reply back only Sending Access-Accept of id 65 to 216.121.193.1 port 49266
rEntitlements += "WIFILOC1"
rAttribute1 = "11111"
rCidx = "11111"
and not as it is happening now....
So why did you put those other rEntitlements into the user profile. If they are not the same thing they shold have different attribute names. Ivan Kalik Kalik Informatika ISP - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
I agree with you. But I am reading those attributes from LDAP. In LDAP "entitlements" attribute is defined as Multivalue (array).
Which is of no use to you.
I can't not change the existing LDAP structure.
Are you a developer or not? If you are, then you say what LDAP structure should look like. If your superiors are in love with that multivalue field insist that data that you need should be kept in a separate attribute as well. Ivan Kalik Kalik Informatika ISP
Ivan, I told the management but looks like no go. is there any way I can change the rlm_ldap.c? I am not proficient in c, so might need additional help. Or there are any other options. Let me know. Thanks in advance. --- On Thu, 10/9/08, tnt@kalik.net <tnt@kalik.net> wrote: From: tnt@kalik.net <tnt@kalik.net> Subject: Re: Radius reply multivalue VSA question. To: freeradius-users@lists.freeradius.org Date: Thursday, October 9, 2008, 1:54 PM
I agree with you. But I am reading those attributes from LDAP. In LDAP "entitlements" attribute is defined as Multivalue (array).
Which is of no use to you.
I can't not change the existing LDAP structure.
Are you a developer or not? If you are, then you say what LDAP structure should look like. If your superiors are in love with that multivalue field insist that data that you need should be kept in a separate attribute as well. Ivan Kalik Kalik Informatika ISP - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
is there any way I can change the rlm_ldap.c?
I am not proficient in c, so might need additional help.
Or there are any other options.
Well, before resorting to source code alterations try using unlang. Have a look at update reply with -= operator. You can't use regex with that operator so you will probably need to run a script that will filter what needs to be removed. http://freeradius.org/radiusd/man/unlang.html Ivan Kalik Kalik Informatika
Thanks Ivan. Not sure which file should I add the update reply? Getting familiar with unlang so pardon my dumb questions. I added in ldap.attrmap. update reply { rEntitlements -= entitlements } replyItem rEntitlements entitlements += is that right? Also you mentioned about script..is that shell/perl script? please enlighten. Thanks in advance. --- On Thu, 10/9/08, tnt@kalik.net <tnt@kalik.net> wrote: From: tnt@kalik.net <tnt@kalik.net> Subject: Re: Radius reply multivalue VSA question. To: freeradius-users@lists.freeradius.org Date: Thursday, October 9, 2008, 4:37 PM
is there any way I can change the rlm_ldap.c?
I am not proficient in c, so might need additional help.
Or there are any other options.
Well, before resorting to source code alterations try using unlang. Have a look at update reply with -= operator. You can't use regex with that operator so you will probably need to run a script that will filter what needs to be removed. http://freeradius.org/radiusd/man/unlang.html Ivan Kalik Kalik Informatika - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Not sure which file should I add the update reply?
Authorize section of default or whatever virtual server is doing the authorization.
I added in ldap.attrmap.
Unlang doesn't work in module configuration files - only server configuration.
Also you mentioned about script..is that shell/perl script?
Yes, you can use exec/perl modules to launch them. Ivan Kalik Kalik Informatika ISP
participants (2)
-
Eric Martell -
tnt＠kalik.net