post-auth help to simplify
Hello, Currently we have the below in the post-auth and I would like to simplify this. if (&LDAP-Group == "RSSO - Group - 01") { update reply { &Tunnel-Type := "VLAN" &Tunnel-Medium-Type := "IEEE-802" &Tunnel-Private-Group-Id := "943" &Class := "RSSO-Group-01" } } elsif (&LDAP-Group == " RSSO - Test - Group - 01 ") { update Reply { &Tunnel-Type := "VLAN" &Tunnel-Medium-Type := "IEEE-802" &Tunnel-Private-Group-Id := "943" &Class := "RSSO-Test-Group-01" } } etc... We have over 70 groups like this, the above is working but I'd like to minimize the changes on the freeradius configuration and was thinking of using regex but not sure if it's possible in my case. As you can see from the above the LDAP-Group and Class differences are the spaces. I was thinking of doing something like the below: if (&LDAP-Group =~ /^RSSO/) { << Match if group starts with RSSO update reply { &Tunnel-Type := "VLAN" &Tunnel-Medium-Type := "IEEE-802" &Tunnel-Private-Group-Id := "943" &Class := "${0}" << is it possible to remove whitespaces? before the update reply? } } Regards, Pizu
I skimmed the docs for a sub-string or trim style method to call on a string, but did fine one. You could use capturing groups in your regex: if (&LDAP-Group == /(^\s?)(RSSO.*)(\s?)/) { Then reference the 2nd group instead of the match with "%{2}" If you're expecting more than a single whitespace, start or end, modify the regex. - Jonathan On 2021-08-30 4:20 a.m., Pizu wrote:
Hello,
Currently we have the below in the post-auth and I would like to simplify this.
if (&LDAP-Group == "RSSO - Group - 01") { update reply { &Tunnel-Type := "VLAN" &Tunnel-Medium-Type := "IEEE-802" &Tunnel-Private-Group-Id := "943" &Class := "RSSO-Group-01" } } elsif (&LDAP-Group == " RSSO - Test - Group - 01 ") { update Reply { &Tunnel-Type := "VLAN" &Tunnel-Medium-Type := "IEEE-802" &Tunnel-Private-Group-Id := "943" &Class := "RSSO-Test-Group-01" } } etc...
We have over 70 groups like this, the above is working but I'd like to minimize the changes on the freeradius configuration and was thinking of using regex but not sure if it's possible in my case. As you can see from the above the LDAP-Group and Class differences are the spaces.
I was thinking of doing something like the below:
if (&LDAP-Group =~ /^RSSO/) { << Match if group starts with RSSO update reply { &Tunnel-Type := "VLAN" &Tunnel-Medium-Type := "IEEE-802" &Tunnel-Private-Group-Id := "943" &Class := "${0}" << is it possible to remove whitespaces? before the update reply? } }
Regards,
Pizu - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Aug 30, 2021, at 4:20 AM, Pizu <pizpower@gmail.com> wrote:
Currently we have the below in the post-auth and I would like to simplify this.
if (&LDAP-Group == "RSSO - Group - 01") { update reply { &Tunnel-Type := "VLAN" &Tunnel-Medium-Type := "IEEE-802" &Tunnel-Private-Group-Id := "943" &Class := "RSSO-Group-01" } } elsif (&LDAP-Group == " RSSO - Test - Group - 01 ") { update Reply { &Tunnel-Type := "VLAN" &Tunnel-Medium-Type := "IEEE-802" &Tunnel-Private-Group-Id := "943" &Class := "RSSO-Test-Group-01" } } etc...
Yeah, that's a lot of repetition.
We have over 70 groups like this, the above is working but I'd like to minimize the changes on the freeradius configuration and was thinking of using regex but not sure if it's possible in my case.
You can't use regexes for LDAP group matching. That's because the user may be in many groups, so there may be many matches to the regular expression. Plus, why set a string value for Class? The Class attribute is just an opaque token. You could just as easily set it to 0x01, or 0x02. There's no need to have a *printable* string. So the question is, are the users a member of only one LDAP group? If so, then there are potential simplifications. If the user is a member of multiple LDAP groups, then an if/then/else chain is really all you can do. Alan DeKok.
Hi, Thanks all for replying. Users have multiple groups but only 1 RSSO Group per user. Regards, Pizu On Mon, 30 Aug 2021 at 14:50, Alan DeKok <aland@deployingradius.com> wrote:
On Aug 30, 2021, at 4:20 AM, Pizu <pizpower@gmail.com> wrote:
Currently we have the below in the post-auth and I would like to simplify this.
if (&LDAP-Group == "RSSO - Group - 01") { update reply { &Tunnel-Type := "VLAN" &Tunnel-Medium-Type := "IEEE-802" &Tunnel-Private-Group-Id := "943" &Class := "RSSO-Group-01" } } elsif (&LDAP-Group == " RSSO - Test - Group - 01 ") { update Reply { &Tunnel-Type := "VLAN" &Tunnel-Medium-Type := "IEEE-802" &Tunnel-Private-Group-Id := "943" &Class := "RSSO-Test-Group-01" } } etc...
Yeah, that's a lot of repetition.
We have over 70 groups like this, the above is working but I'd like to minimize the changes on the freeradius configuration and was thinking of using regex but not sure if it's possible in my case.
You can't use regexes for LDAP group matching. That's because the user may be in many groups, so there may be many matches to the regular expression.
Plus, why set a string value for Class? The Class attribute is just an opaque token. You could just as easily set it to 0x01, or 0x02. There's no need to have a *printable* string.
So the question is, are the users a member of only one LDAP group? If so, then there are potential simplifications. If the user is a member of multiple LDAP groups, then an if/then/else chain is really all you can do.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Aug 30, 2021, at 9:50 AM, Pizu <pizpower@gmail.com> wrote:
Users have multiple groups but only 1 RSSO Group per user.
Then don't use LDAP-Group for this purpose. There are other ways of getting the same result which are more efficient. Use the command-line "ldapsearch" tool to find an LDAP query which returns ONLY the RSSO group name for a user. In recent versions of the server, there's documentation in mods-available/ldap on how to translate the "ldapsearch" command-line options to the "ldap" module configuration. Once you have the "ldapsearch" working, you can turn this into the FreeRADIUS configuration. Use the ldapsearch string in a dynamic expansion: update control { Tmp-String-0 := "%{ldap:... search for RSSO group}" } Now you have the name of the LDAP group in a variable. if (Tmp-String-0 != "") { update reply { &Tunnel-Type := "VLAN" &Tunnel-Medium-Type := "IEEE-802 &Tunnel-Private-Group-Id := "943 &Class := "%{Tmp-String-0}" } } Alan DeKok.
participants (3)
-
Alan DeKok -
Jonathan Davis -
Pizu