configuration for retrieving LDAP security group membership
I need to configure FreeRADIUS Version 2.2.6 to retrieve LDAP security group membership, and am hoping someone here can help. In this case I have a web application that queries FreeRADIUS. FreeRADIUS then goes to the LDAP server and authenticates the user. User authentication works, but I've tried a couple of things to get the LDAP server to return security group membership with no luck. I have added and included a dictionary file with a definition of my vendor-defined attribute as follows: VENDOR Uplogix 10243 BEGIN-VENDOR Uplogix ATTRIBUTE Uplogix-User-Groups 3 string After reading through available documentation, I tried to return the groups with the following in the /erc/raddb/users file, but it doesn't work: DEFAULT Uplogix-User-Groups = Ldap-Group Should I instead be requesting the LDAP group in the post-auth section of the LDAP module? If so can I get an example of how the syntax should work for that? Thanks in advance, Adam Thompson
On Dec 13, 2016, at 4:31 PM, Adam Thompson <athompson@uplogix.com> wrote:
I need to configure FreeRADIUS Version 2.2.6 to retrieve LDAP security group membership, and am hoping someone here can help.
It can retrieve LDAP group membership, mostly. But it's really limited to checking LDAP group membership.
In this case I have a web application that queries FreeRADIUS. FreeRADIUS then goes to the LDAP server and authenticates the user. User authentication works, but I've tried a couple of things to get the LDAP server to return security group membership with no luck.
You can just do an LDAP query, and return that. Or, use v3, which caches LDAP group membership. Version 2 is old and no longer supported. Alan DeKok.
I'm stuck with v 2.2.6, unfortunately. For the LDAP query, should I add an "update" section to get the group membership? Where should that go, in the LDAP section of the configuration? Something like the following? update { reply:Uplogix-User-Groups := 'Ldap-Group' } Thanks, Adam -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+athompson=uplogix.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Tuesday, December 13, 2016 4:48 PM To: FreeRadius users mailing list Subject: Re: configuration for retrieving LDAP security group membership On Dec 13, 2016, at 4:31 PM, Adam Thompson <athompson@uplogix.com> wrote:
I need to configure FreeRADIUS Version 2.2.6 to retrieve LDAP security group membership, and am hoping someone here can help.
It can retrieve LDAP group membership, mostly. But it's really limited to checking LDAP group membership.
In this case I have a web application that queries FreeRADIUS. FreeRADIUS then goes to the LDAP server and authenticates the user. User authentication works, but I've tried a couple of things to get the LDAP server to return security group membership with no luck.
You can just do an LDAP query, and return that. Or, use v3, which caches LDAP group membership. Version 2 is old and no longer supported. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Dec 14, 2016, at 11:02 AM, Adam Thompson <athompson@uplogix.com> wrote:
I'm stuck with v 2.2.6, unfortunately.
There is no technical reason which prevents you from upgrading.
For the LDAP query, should I add an "update" section to get the group membership? Where should that go, in the LDAP section of the configuration?
No. You cannot retrieve LDAP groups like that in v2. It only works in v3. Alan DeKok.
All, I managed to get FreeeRADIUS 2.2.6 to return LDAP group membership, but now I need to clean up the output - anyone have suggestions on how to do that? I added this to my config: post-auth { update reply { Uplogix-User-Groups := " %{reply:Uplogix-JUNK[0]} , %{reply:Uplogix-JUNK[1]} , %{reply:Uplogix-JUNK[2]} , %{reply:Uplogix-JUNK[3]} , %{reply:Uplogix-JUNK[4]} , %{reply:Uplogix-JUNK[5]}" Uplogix-JUNK !* ANY } } Now the server returns output like: ++update reply { expand: %{reply:Uplogix-JUNK[0]} , %{reply:Uplogix-JUNK[1]} , %{reply:Uplogix-JUNK[2]} , %{reply:Uplogix-JUNK[3]} , %{reply:Uplogix-JUNK[4]} , %{reply:Uplogix-JUNK[5]} -> CN=evaluation,CN=Users,DC=doc,DC=uplogix,DC=com , CN=Administrators,CN=Builtin,DC=doc,DC=uplogix,DC=com , , , , ++} # update reply = noop +} # group post-auth = noop Sending Access-Accept of id 19 to 203.0.113.8 port 63394 Uplogix-User-Groups = " CN=evaluation,CN=Users,DC=doc,DC=uplogix,DC=com , CN=Administrators,CN=Builtin,DC=doc,DC=uplogix,DC=com , , , , " Finished request 0. Going to the next request Waking up in 4.9 seconds. Does anyone have suggestions for how to clean up the output? At first I thought I could use the !~ and =~, but it looks like those can only be used to evaluate, not to change the contents of the reply. TIA -Adam -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+athompson=uplogix.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Wednesday, December 14, 2016 10:38 AM To: FreeRadius users mailing list Subject: Re: configuration for retrieving LDAP security group membership On Dec 14, 2016, at 11:02 AM, Adam Thompson <athompson@uplogix.com> wrote:
I'm stuck with v 2.2.6, unfortunately.
There is no technical reason which prevents you from upgrading.
For the LDAP query, should I add an "update" section to get the group membership? Where should that go, in the LDAP section of the configuration?
No. You cannot retrieve LDAP groups like that in v2. It only works in v3. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Specifically, I'm looking to strip out the "CN=Users,DC=doc,DC=uplogix,DC=com" etc, so that I just have group names... A -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+athompson=uplogix.com@lists.freeradius.org] On Behalf Of Adam Thompson Sent: Monday, January 16, 2017 1:25 PM To: FreeRadius users mailing list Subject: RE: configuration for retrieving LDAP security group membership All, I managed to get FreeeRADIUS 2.2.6 to return LDAP group membership, but now I need to clean up the output - anyone have suggestions on how to do that? I added this to my config: post-auth { update reply { Uplogix-User-Groups := " %{reply:Uplogix-JUNK[0]} , %{reply:Uplogix-JUNK[1]} , %{reply:Uplogix-JUNK[2]} , %{reply:Uplogix-JUNK[3]} , %{reply:Uplogix-JUNK[4]} , %{reply:Uplogix-JUNK[5]}" Uplogix-JUNK !* ANY } } Now the server returns output like: ++update reply { expand: %{reply:Uplogix-JUNK[0]} , %{reply:Uplogix-JUNK[1]} , %{reply:Uplogix-JUNK[2]} , %{reply:Uplogix-JUNK[3]} , %{reply:Uplogix-JUNK[4]} , %{reply:Uplogix-JUNK[5]} -> CN=evaluation,CN=Users,DC=doc,DC=uplogix,DC=com , CN=Administrators,CN=Builtin,DC=doc,DC=uplogix,DC=com , , , , ++} # update reply = noop +} # group post-auth = noop Sending Access-Accept of id 19 to 203.0.113.8 port 63394 Uplogix-User-Groups = " CN=evaluation,CN=Users,DC=doc,DC=uplogix,DC=com , CN=Administrators,CN=Builtin,DC=doc,DC=uplogix,DC=com , , , , " Finished request 0. Going to the next request Waking up in 4.9 seconds. Does anyone have suggestions for how to clean up the output? At first I thought I could use the !~ and =~, but it looks like those can only be used to evaluate, not to change the contents of the reply. TIA -Adam -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+athompson=uplogix.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Wednesday, December 14, 2016 10:38 AM To: FreeRadius users mailing list Subject: Re: configuration for retrieving LDAP security group membership On Dec 14, 2016, at 11:02 AM, Adam Thompson <athompson@uplogix.com> wrote:
I'm stuck with v 2.2.6, unfortunately.
There is no technical reason which prevents you from upgrading.
For the LDAP query, should I add an "update" section to get the group membership? Where should that go, in the LDAP section of the configuration?
No. You cannot retrieve LDAP groups like that in v2. It only works in v3. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
post-auth { update reply { Uplogix-User-Groups := " %{reply:Uplogix-JUNK[0]} , %{reply:Uplogix-JUNK[1]} , %{reply:Uplogix-JUNK[2]} , %{reply:Uplogix-JUNK[3]} , %{reply:Uplogix-JUNK[4]} , %{reply:Uplogix-JUNK[5]}" Uplogix-JUNK !* ANY } } [8<] At first I thought I could use the !~ and =~, but it looks like those can only be used to evaluate, not to change the contents of the reply.
You use exactly those like this (MileageMayVaryTM): if ("%{Uplogix-JUNK[0]}" =~ /(.*),DC=doc,DC=uplogix,DC=com$/) { if ("%{1}" =~ /(.*),DC(.*)$/) { update reply { Uplogix-JUNK[0] := "%{1}" } } } : : : FR3 has a lovely 'foreach' operator where you can loop through the entire array of Uplogix-JUNK and do this instead of a series of if statements... With Regards Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp@jabber.dev.ja.net skype: stefan.paetow.janet jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc¹s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.
Stefan, I had to change it a little, but your suggestion works - I owe you a beer next time I'm in the UK. Here's what I ended up with (for posterity): post-auth { if ("%{reply:Uplogix-JUNK[0]}" =~ /(.*),CN=Users,DC=doc,DC=uplogix,DC=com$/) { if ("%{1}" =~ /CN=(.*)/) { update reply { Uplogix-GROUP1 := "%{1}" } } } if ("%{reply:Uplogix-JUNK[1]}" =~ /(.*),CN=Users,DC=doc,DC=uplogix,DC=com$/) { if ("%{1}" =~ /CN=(.*)/) { update reply { Uplogix-GROUP2 := "%{1}" } } } if ("%{reply:Uplogix-JUNK[2]}" =~ /(.*),CN=Users,DC=doc,DC=uplogix,DC=com$/) { if ("%{1}" =~ /CN=(.*)/) { update reply { Uplogix-GROUP3 := "%{1}" } } } if ("%{reply:Uplogix-JUNK[3]}" =~ /(.*),CN=Users,DC=doc,DC=uplogix,DC=com$/) { if ("%{1}" =~ /CN=(.*)/) { update reply { Uplogix-GROUP4 := "%{1}" } } } if ("%{reply:Uplogix-JUNK[4]}" =~ /(.*),CN=Users,DC=doc,DC=uplogix,DC=com$/) { if ("%{1}" =~ /CN=(.*)/) { update reply { Uplogix-GROUP5 := "%{1}" } } } update reply { Uplogix-User-Groups := " %{reply:Uplogix-GROUP1} , %{reply:Uplogix-GROUP2} , %{reply:Uplogix-GROUP3} , %{reply:Uplogix-GROUP4} , %{reply:Uplogix-GROUP5}" Uplogix-JUNK !* ANY } Cheers, Adam -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+athompson=uplogix.com@lists.freeradius.org] On Behalf Of Stefan Paetow Sent: Monday, January 16, 2017 2:08 PM To: FreeRadius users mailing list Subject: Re: configuration for retrieving LDAP security group membership
post-auth { update reply { Uplogix-User-Groups := " %{reply:Uplogix-JUNK[0]} , %{reply:Uplogix-JUNK[1]} , %{reply:Uplogix-JUNK[2]} , %{reply:Uplogix-JUNK[3]} , %{reply:Uplogix-JUNK[4]} , %{reply:Uplogix-JUNK[5]}" Uplogix-JUNK !* ANY } } [8<] At first I thought I could use the !~ and =~, but it looks like those can only be used to evaluate, not to change the contents of the reply.
You use exactly those like this (MileageMayVaryTM): if ("%{Uplogix-JUNK[0]}" =~ /(.*),DC=doc,DC=uplogix,DC=com$/) { if ("%{1}" =~ /(.*),DC(.*)$/) { update reply { Uplogix-JUNK[0] := "%{1}" } } } : : : FR3 has a lovely 'foreach' operator where you can loop through the entire array of Uplogix-JUNK and do this instead of a series of if statements... With Regards Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp@jabber.dev.ja.net skype: stefan.paetow.janet jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc¹s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Jan 17, 2017, at 12:22 PM, Adam Thompson <athompson@uplogix.com> wrote:
Stefan,
I had to change it a little, but your suggestion works - I owe you a beer next time I'm in the UK.
Here's what I ended up with (for posterity):
post-auth {
if ("%{reply:Uplogix-JUNK[0]}" =~ /(.*),CN=Users,DC=doc,DC=uplogix,DC=com$/) { if ("%{1}" =~ /CN=(.*)/) {
You can simplify those two regular expressions into one: if "%{reply:Uplogix-JUNK[0]}" =~ /CN=([^,]+),CN=Users,DC=doc,DC=uplogix,DC=com$/) { The key is that ".*" also matches "CN=", which is *not* what you want. So instead of ".*", you use an exclusion list. The simplest is [^,] i.e. "match CN=, and then grab everything until the next comma". Alan DeKok.
You can simplify those two regular expressions into one: if "%{reply:Uplogix-JUNK[0]}" =~ /CN=([^,]+),CN=Users,DC=doc,DC=uplogix,DC=com$/) {
Yeah, I didn't know off-hand what the regex for that was, so I fudged it. Come on, give a guy a break ;-) Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp@jabber.dev.ja.net skype: stefan.paetow.janet jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc¹s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.
On Jan 17, 2017, at 5:25 PM, Stefan Paetow <Stefan.Paetow@JISC.AC.UK> wrote:
You can simplify those two regular expressions into one: if "%{reply:Uplogix-JUNK[0]}" =~ /CN=([^,]+),CN=Users,DC=doc,DC=uplogix,DC=com$/) {
Yeah, I didn't know off-hand what the regex for that was, so I fudged it. Come on, give a guy a break ;-)
Sure... FWIW, the skills I need to do RADIUS are: RADIUS, 802.1X, TLS, certificate management, networking (IP, TCP, UDP, ICMP, ARP, ...), C programming (posix, sockets, threads, ...), regular expressions, "configure" scripts, GNU Make rules, etc. It's a wonder it all fits. :( Alan DeKok.
Alan DeKok wrote:
FWIW, the skills I need to do RADIUS are:
RADIUS, 802.1X, TLS, certificate management, networking (IP, TCP, UDP, ICMP, ARP, ...), C programming (posix, sockets, threads, ...), regular expressions, "configure" scripts, GNU Make rules, etc.
You forgot the database backends and embedded scripting languages...
It's a wonder it all fits. :(
We'll see how all this IT complexity works in the long run... Ciao, Michael.
participants (4)
-
Adam Thompson -
Alan DeKok -
Michael Ströder -
Stefan Paetow