RADIUS reading LDAP attributes
Hi all, I have a freeradius 2.1.3 running and I can successfully authenticate users. I would like to use a users LDAP attribute so I can provide them with different permissions on the proxy server. I have currently mapped a RADIUS attribute to the LDAP attribute and it successfully reads the attribute when a user is authenticating.
From radiusd -X:
rlm_ldap: description -> My-Local-LDAP-Comment = "STAFF" So the user in question has STAFF as a comment in his ldap description attribute. I have added the My-Local-LDAP-Comment into the raddb/dictionary file like this: ATTRIBUTE My-Local-LDAP-Comment 3000 string and in the raddb/ldap.attrmap I have added: replyItem My-Local-LDAP-Comment description Now, what I am failing to understand is how I can get the proxy server to receive the My-Local-LDAP-Comment attribute from RADIUS, so I can make rules depending on its contents? Any suggestions on what to do, or which documentation to read would be appreciated. Thanks, Sigurd
Sigurd Foshaug wrote:
I have added the My-Local-LDAP-Comment into the raddb/dictionary file like this:
ATTRIBUTE My-Local-LDAP-Comment 3000 string ... Now, what I am failing to understand is how I can get the proxy server to receive the My-Local-LDAP-Comment attribute from RADIUS,
Read the comments in the dictionary file that you edited. They explain why that attribute is not being placed in a RADIUS packet.
Any suggestions on what to do, or which documentation to read would be appreciated.
$ man dictionary This is documented. Alan DeKok.
Thanks Alan, I added an reply message item inside the authentication section which expands the My-Local-LDAP-Comment attribute. It now works as expected. Thanks, Sigurd On Thu, Aug 26, 2010 at 11:53 AM, Alan DeKok <aland@deployingradius.com>wrote:
Sigurd Foshaug wrote:
I have added the My-Local-LDAP-Comment into the raddb/dictionary file like this:
ATTRIBUTE My-Local-LDAP-Comment 3000 string ... Now, what I am failing to understand is how I can get the proxy server to receive the My-Local-LDAP-Comment attribute from RADIUS,
Read the comments in the dictionary file that you edited. They explain why that attribute is not being placed in a RADIUS packet.
Any suggestions on what to do, or which documentation to read would be appreciated.
$ man dictionary
This is documented.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (2)
-
Alan DeKok -
Sigurd Foshaug