[Patch] rlm_ldap: Allow users to match more than one group
Hi all, If you set up groups in the rlm_ldap module, and a user is found to match more than one group, that user is currently denied access. For example, you might have a "staff" and "student" group, and a staff member comes along and enrolls as a part time student, suddenly they unexpectedly lose access to radius because they are a member of both groups. The following patch adds the groupmembership_limit option, defaulting to 1 (the current behavior). It allows you to limit the number of groups a user might be a member of, or remove the limit entirely (set to zero). Regards, Graham --
On 11/01/12 11:41, Graham Leggett wrote:
Hi all,
If you set up groups in the rlm_ldap module, and a user is found to match more than one group, that user is currently denied access.
I'm not sure I understand the circumstances in which this occurs. Can you give an example of it failing? rlm_ldap takes the "groupmembership_filter" you give it, and then ANDs it with groupname=value, like so: final_filter = sprintf("(&(%s=%s)%s)" groupname_attr, groupname, groupmembership_filter ) This query will end up looking something like this: (&(cn=TheGroup)(|(member=<LDAP DN>)(uniquemember=<LDAP DN>))) ...and should never return >1 hit.
On 11 Jan 2012, at 3:06 PM, Phil Mayers wrote:
I'm not sure I understand the circumstances in which this occurs. Can you give an example of it failing?
rlm_ldap takes the "groupmembership_filter" you give it, and then ANDs it with groupname=value, like so:
final_filter = sprintf("(&(%s=%s)%s)" groupname_attr, groupname, groupmembership_filter )
This query will end up looking something like this:
(&(cn=TheGroup)(|(member=<LDAP DN>)(uniquemember=<LDAP DN>)))
...and should never return >1 hit.
That assumes you're searching using a group name. In my case, I have an attribute that has a value that means "give this group of people access to radius", and for some people, they will be members of more than one group. In the process, they are denied access because 2 or more values come back. This patch gives the admin the power to support this scenario when it is required. Regards, Graham --
participants (2)
-
Graham Leggett -
Phil Mayers