DNS attribute per group
I'm a newbie in freeradius, I have a production freeradius server connected with ldap directory, currently I'm assigning dns attribute(primary and secondary) in post-auth, the same servers for every user , It works fine but we need now to assign different dns server depending of their group. (O=). We don't know if check it in ldap or using groups in SQL.(radusergroup) , any idea? Thanks in advance Martin
On Aug 7, 2019, at 9:45 AM, Tomride via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
I'm a newbie in freeradius, I have a production freeradius server connected with ldap directory, currently I'm assigning dns attribute(primary and secondary) in post-auth, the same servers for every user , It works fine but we need now to assign different dns server depending of their group. (O=). We don't know if check it in ldap or using groups in SQL.(radusergroup) , any idea?
if (LDAP-Group == "sales") { update reply { attribute = value } } https://wiki.freeradius.org/modules/Rlm_ldap Alan DeKok.
Thanks so much alan for your help, unfornately by the special configuration of the tree we can't do it with Ldap-groups , is it possible to do for organizationName or attribute of the user? Thanks in advance Martin -------- Mensaje original -------- On 7 ago. 2019 16:19, Alan DeKok escribió:
On Aug 7, 2019, at 9:45 AM, Tomride via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
I'm a newbie in freeradius, I have a production freeradius server connected with ldap directory, currently I'm assigning dns attribute(primary and secondary) in post-auth, the same servers for every user , It works fine but we need now to assign different dns server depending of their group. (O=). We don't know if check it in ldap or using groups in SQL.(radusergroup) , any idea?
if (LDAP-Group == "sales") { update reply { attribute = value } }
https://wiki.freeradius.org/modules/Rlm_ldap
Alan DeKok.
On Fri, 2019-08-09 at 07:22 +0000, Tomride via Freeradius-Users wrote:
Thanks so much alan for your help, unfornately by the special configuration of the tree we can't do it with Ldap-groups , is it possible to do for organizationName or attribute of the user?
You can alter the ldap search/filter in the ldap configuration to look up pretty much whatever you want. See membership_filter and membership_attribute. You probably want the former. Run FreeRADIUS in debug mode (-X) and send a request. You'll see the LDAP searches being performed. Substitute in the config that searches for the things you need it to search for. -- Matthew
participants (3)
-
Alan DeKok -
Matthew Newton -
Tomride