Why does 'switch' and case don't work?
Hi, switch statement in post-auth section doesn't work, see below. ============= switch &LDAP-Group { case "network-admins" { update reply { Service-Type = "NAS-Prompt-User", Huawei-Exec-Privilege = "3", Login-Service = 50, } } case "network-0" { update reply { Service-Type = "NAS-Prompt-User", Huawei-Exec-Privilege = "0", Login-Service = 50, } } case { reject } } ========================= It always comes down to the 'default' reject part, it looks like <LDAP-Group > match nothing. where if/elsif/else works as expected. What's wrong with my statement above?
On Tue, 2017-11-21 at 17:54 +0800, luckydog xf wrote:
switch statement in post-auth section doesn't work, see below.
============= switch &LDAP-Group {
Rather than "switch doesn't work", look at what LDAP-Group expands to.
It always comes down to the 'default' reject part, it looks like <LDAP-Group > match nothing.
What does the -X debug output show? My guess is LDAP-Group isn't expanding to what you expect it to in the in post-auth section. -- Matthew
On Nov 21, 2017, at 4:54 AM, luckydog xf <luckydogxf@gmail.com> wrote:
switch statement in post-auth section doesn't work, see below.
Yes, they do work. There are tests that run every day for them.
============= switch &LDAP-Group {
You can't look at the value of LDAP-Group like that. You can do: if (LDAP-Group == "admins") ... That checks of the user is part of the "admins" group. But the user may be part of tens to thousands of LDAP groups. All of those values are stored in the LDAP server, not in FreeRADIUS Change the "switch" to use if / else, and it will work. Alan DeKok.
:) Just to be clear, FreeRADIUS is a GREAT stuff. Yes using if/elsif/else works, yet i'm curious why switch and case combination doesn't. $LDAP-Group in switch statement expands nothing from `raidus -X`, in other words, LDAP-Group is null, that's why it always goes down to `default` of case statement. . On Tue, Nov 21, 2017 at 9:15 PM, Alan DeKok <aland@deployingradius.com> wrote:
On Nov 21, 2017, at 4:54 AM, luckydog xf <luckydogxf@gmail.com> wrote:
switch statement in post-auth section doesn't work, see below.
Yes, they do work. There are tests that run every day for them.
============= switch &LDAP-Group {
You can't look at the value of LDAP-Group like that. You can do:
if (LDAP-Group == "admins") ...
That checks of the user is part of the "admins" group. But the user may be part of tens to thousands of LDAP groups. All of those values are stored in the LDAP server, not in FreeRADIUS
Change the "switch" to use if / else, and it will work.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html
participants (3)
-
Alan DeKok -
luckydog xf -
Matthew Newton