Variables' content as a reply
Hello all! I've been trying unsuccessfully to get this setup to work, but unfortunately haven't been able so far. My need is to return the contents of three LDAP fields as replies on the Access-Accept package. The setup is for EAP/TTLS, mostly following eduRoam's setup guide (EduROAM Cookbook -- DJ 5.1.5,3). My config is as follows: on ldap.attrmap:
checkItem cLDAPdepartmentNumber departmentNumber replyItem rLDAPdepartmentNumber departmentNumber checkItem cLDAPaffiliation eduPersonPrimaryAffiliation replyItem rLDAPaffiliation eduPersonPrimaryAffiliation checkItem cLDAPou ou replyItem rLDAPou ou
on dictionary.university:
VENDOR Unicamp 12345
BEGIN-VENDOR Unicamp ATTRIBUTE University-LDAP-departmentNumber 1 string ATTRIBUTE University-LDAP-affiliation 2 string ATTRIBUTE University-LDAP-organizationUnit 3 string END-VENDOR University
(the attributes, at least, are recognized correctly on the reply). on the inner-tunnel configuration file::
post-auth { reply_log Post-Auth-Type REJECT { reply_log } redundant { sql-server1 sql-server2 } update outer.reply { User-Name := %{reply:User-Name} University-LDAP-departmentNumber := %{rLDAPdepartmentNumber} }
radiusd -v is:
radiusd: FreeRADIUS Version 2.1.3, for host i386-portbld-freebsd7.0, built on Jan 9 2009 at 07:02:31
but unfortunately, something does not translate right: From that I've gathered running on radiusd -X, the relevant parts are: - first, an error on rlm_ldap:
++- entering policy redundant {...} [ldap1] performing user authorization for user@university [ldap1] expand: (eduPersonPrincipalName=%{User-Name}) -> (eduPersonPrincipalName=user@university) [ldap1] expand: dc=university -> dc=university rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldap1.university:389, authentication 0 rlm_ldap: starting TLS rlm_ldap: bind as / to ldap1.university:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=university, with filter (eduPersonPrincipalName=user@university) [ldap1] checking if remote access for user@university is allowed by dialupAccess [ldap1] looking for check items in directory... rlm_ldap: Failed to create the pair: Invalid octet string "cc " for attribute name "cLDAPou" rlm_ldap: Failed to create the pair: Invalid octet string "staff" for attribute name "cLDAPaffiliation" rlm_ldap: Failed to create the pair: Invalid octet string "20.5.2.4.0.0.0" for attribute name "cLDAPdepartmentNumber" rlm_ldap: radiusSimultaneousUse -> Simultaneous-Use == 1 [ldap1] looking for reply items in directory... rlm_ldap: Failed to create the pair: Invalid octet string "cc " for attribute name "rLDAPou" rlm_ldap: Failed to create the pair: Invalid octet string "staff" for attribute name "rLDAPaffiliation" rlm_ldap: Failed to create the pair: Invalid octet string "20.5.2.4.0.0.0" for attribute name "rLDAPdepartmentNumber" WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap1] Setting Auth-Type = LDAP [ldap1] user user@university authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap1] returns ok
- second: the reply's content is not getting translated right. Instead of sending the content's of the variables, it just sends the variable names outright:
Sending Access-Accept of id 235 to xxx.xxx.xxx.xxx port 32783 User-Name = "%{reply:User-Name}" University-LDAP-departmentNumber = "%{rLDAPdepartmentNumber}" MS-MPPE-Recv-Key = blah MS-MPPE-Send-Key = blah EAP-Message = 0x03050004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 5.
So, the most important question is: how do i reference the content's of the variables on the post-auth update section? Second: what's causing the check and reply items not to get translated? could this be an LDAP error or is there an error on the ldap.attrmap file? By the way, the authentication, authorization, everything is working fine already (including the TTLS/PAP part). Thanks in advance for any thoughts..
I've been trying unsuccessfully to get this setup to work, but unfortunately haven't been able so far.
My need is to return the contents of three LDAP fields as replies on the Access-Accept package.
The setup is for EAP/TTLS, mostly following eduRoam's setup guide (EduROAM Cookbook -- DJ 5.1.5,3). My config is as follows:
on ldap.attrmap:
checkItem cLDAPdepartmentNumber departmentNumber replyItem rLDAPdepartmentNumber departmentNumber checkItem cLDAPaffiliation eduPersonPrimaryAffiliation replyItem rLDAPaffiliation eduPersonPrimaryAffiliation checkItem cLDAPou ou replyItem rLDAPou ou
Where does the cookbook say that you should put that in ldap.attrmap? Where are those radius attributes defined? Some additional dictionary?
on dictionary.university:
VENDOR Unicamp 12345
BEGIN-VENDOR Unicamp ATTRIBUTE University-LDAP-departmentNumber 1 string ATTRIBUTE University-LDAP-affiliation 2 string ATTRIBUTE University-LDAP-organizationUnit 3 string END-VENDOR University
Why don't you map those in ldap.attrmap.
(the attributes, at least, are recognized correctly on the reply).
on the inner-tunnel configuration file::
post-auth { reply_log Post-Auth-Type REJECT { reply_log } redundant { sql-server1 sql-server2 } update outer.reply { User-Name := %{reply:User-Name} University-LDAP-departmentNumber := %{rLDAPdepartmentNumber} }
That should be: User-Name := '%{reply:User-Name}' University-LDAP-departmentNumber := '%{rLDAPdepartmentNumber}' Ivan Kalik Kalik Informatika ISP
Where does the cookbook say that you should put that in ldap.attrmap? Where are those radius attributes defined? Some additional dictionary? This part is not from the cookbook, it's something we intend to use internally here at the university. The setup is based on the eduroam guide, though, except for these attributes and the need to return the inner User-Name on the outside of the tunnel.
Why don't you map those in ldap.attrmap. That had actually never ocurred to me. I thought ldap.attrmap was used to create the variables and populate them with values, but it never ocurred me to use it just for attribution. That has worked flawlessly, thank you.
Just so it's posted on the list, my solution in this case is as follows: on ldap.attrmap: [...] replyItem University-LDAP-organizationUnit ou replyItem University-LDAP-departmentNumber departmentNumber replyItem University-LDAP-affiliation eduPersonPrimaryAffiliation [...]
on the inner-tunnel configuration file:
post-auth { update outer.reply { User-Name := %{reply:User-Name} University-LDAP-departmentNumber := %{rLDAPdepartmentNumber} }
That should be:
User-Name := '%{reply:User-Name}' University-LDAP-departmentNumber := '%{rLDAPdepartmentNumber}'
Now, this is still not working: having it as User-Name := '%{reply:User-Name}' still gives me an Access-Accept with text instead of variable value. Also, using double quotes yields the exact same result.
Sending Access-Accept of id 127 to xx.xx.xx.xx port 32785 User-Name = "%{reply:User-Name}" University-LDAP-organizationUnit = "cc " University-LDAP-affiliation = "staff" University-LDAP-departmentNumber = "20.5.2.4.0.0.0" MS-MPPE-Recv-Key = 0xecf20a153c749b7fa673b83360456fc9d5eb3080eaacdce7034dc6a69fe3ec3a MS-MPPE-Send-Key = 0x19632e43f61546fc38a26e0e71ef134ecd45dae99873af6040606bc2772bbd75 EAP-Message = 0x03190004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 6.
My need is to return the inner username (from within the TTLS tunnel) to the outside of the access-accept response.. Is there any other simpler way of doing this that I'm not aware? Thanks again for the help
Ivan Kalik Kalik Informatika ISP
Guto
Now, this is still not working:
having it as User-Name := '%{reply:User-Name}' still gives me an Access-Accept with text instead of variable value. Also, using double quotes yields the exact same result.
Sending Access-Accept of id 127 to xx.xx.xx.xx port 32785 User-Name = "%{reply:User-Name}" University-LDAP-organizationUnit = "cc " University-LDAP-affiliation = "staff" University-LDAP-departmentNumber = "20.5.2.4.0.0.0" MS-MPPE-Recv-Key = 0xecf20a153c749b7fa673b83360456fc9d5eb3080eaacdce7034dc6a69fe3ec3a MS-MPPE-Send-Key = 0x19632e43f61546fc38a26e0e71ef134ecd45dae99873af6040606bc2772bbd75 EAP-Message = 0x03190004 Message-Authenticator = 0x00000000000000000000000000000000
Sorry, it's "%{reply:User-Name}". From man unlang about strings: "Double-quoted strings are expanded by inserting the value of any variables (see VARIABLES, below) before being evaluated. If the result is a number it is evaluated in a numerical context. .. Single-quoted strings are evaluated as-is. Their values are not expanded as with double-quoted strings above, and they are not interpreted as attribute references." Ivan Kalik Kalik Informatika ISP Ivan Kalik Kalik Informatika ISP
Sorry, it's "%{reply:User-Name}". From man unlang about strings:
"Double-quoted strings are expanded by inserting the value of any variables (see VARIABLES, below) before being evaluated. If the result is a number it is evaluated in a numerical context.
..
Single-quoted strings are evaluated as-is. Their values are not expanded as with double-quoted strings above, and they are not interpreted as attribute references."
I got it to work, you were right on target about the double-quotes. My real problem was that I was simply pointing to the wrong thing. My original block was reading
update outer.reply { User-Name := "%{reply:User-Name}" }
That returns empty, since the inner reply does not contain any User-Name information. The correct block (which is working now) is:
update outer.reply { User-Name := "%{request:User-Name}" }
So, everything seems fine now.. Thanks all for your help, especially Kalik.. :)
participants (2)
-
Augusto G. Andreollo -
tnt＠kalik.net