FR3 reply ldap's attr when bind as a user
I can bind as a user by configure in virtual server authorize { update { control:Auth-Type := ldap } } It works well and can authenticate a user with LDAP . The "radiusd -X" output like (2) ldap : Performing search in 'ou=a,dc=b,dc=domain' with filter '(sAMAccountName=abc)' (2) ldap : Waiting for search result... (2) ldap : User object found at DN "CN=s,OU=s,OU=s,OU=a,DC=b,DC=domain" (2) ldap : Waiting for bind result... (2) ldap : Bind successful (2) ldap : Bind as user "CN=a,OU=ab,OU=a,OU=qiyi,DC=b,DC=domain" was successful What I want to do is update reply:Reply-Message with the user information, such as reply:Reply-Message := "CN=a,OU=ab,OU=a,OU=qiyi,DC=b,DC=domain" I've tried to update reply in "mods-available/ldap", but it not work. Is it possible? Any suggestions will be appreciated.
On 1 Mar 2014, at 07:50, zz d <zzd7zzd@gmail.com> wrote:
I can bind as a user by configure in virtual server authorize { update { control:Auth-Type := ldap } } It works well and can authenticate a user with LDAP . The "radiusd -X" output like (2) ldap : Performing search in 'ou=a,dc=b,dc=domain' with filter '(sAMAccountName=abc)' (2) ldap : Waiting for search result... (2) ldap : User object found at DN "CN=s,OU=s,OU=s,OU=a,DC=b,DC=domain" (2) ldap : Waiting for bind result... (2) ldap : Bind successful (2) ldap : Bind as user "CN=a,OU=ab,OU=a,OU=qiyi,DC=b,DC=domain" was successful What I want to do is update reply:Reply-Message with the user information, such as reply:Reply-Message := "CN=a,OU=ab,OU=a,OU=qiyi,DC=b,DC=domain" I've tried to update reply in "mods-available/ldap", but it not work.
You need to list the LDAP module in Post-Auth or Accounting... Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
On 1 Mar 2014, at 08:42, Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:
On 1 Mar 2014, at 07:50, zz d <zzd7zzd@gmail.com> wrote:
I can bind as a user by configure in virtual server authorize { update { control:Auth-Type := ldap } } It works well and can authenticate a user with LDAP . The "radiusd -X" output like (2) ldap : Performing search in 'ou=a,dc=b,dc=domain' with filter '(sAMAccountName=abc)' (2) ldap : Waiting for search result... (2) ldap : User object found at DN "CN=s,OU=s,OU=s,OU=a,DC=b,DC=domain" (2) ldap : Waiting for bind result... (2) ldap : Bind successful (2) ldap : Bind as user "CN=a,OU=ab,OU=a,OU=qiyi,DC=b,DC=domain" was successful What I want to do is update reply:Reply-Message with the user information, such as reply:Reply-Message := "CN=a,OU=ab,OU=a,OU=qiyi,DC=b,DC=domain" I've tried to update reply in "mods-available/ldap", but it not work.
You need to list the LDAP module in Post-Auth or Accounting...
Oops. Sorry, I misread your message because your config is so broken. RHS in update block is an attribute name, NOT a DN, there are clear and explicit instructions about how to use the update block RIGHT ABOVE THE UPDATE BLOCK. I advise you READ THEM. https://github.com/FreeRADIUS/freeradius-server/blob/master/raddb/mods-avail... Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
Thanks Arran. I provided the config like that is because I want to show the key part of it. Actually, I've read "mods-available/ldap" servral times before I post the mail. As shown in Figure below: Request Client ---> FreeRADIUS server <--> LDAP <--- Reply I've tried to configure in "mods-available/ldap" as "<radius attr> <op> <ldap attr>" like 1. reply:Reply-Message = 'mail' 2. Reply-Message = 'mail' 3. update { reply:Reply-Message = 'mail' } But the Reply in Figure does not contail attr Reply-Message. Is my "<ldap attr>" invalid? I've also tried "Mail / Name / name". Thanks for your answer again. 2014-03-02 18:08 GMT+08:00 Arran Cudbard-Bell <a.cudbardb@freeradius.org>:
On 1 Mar 2014, at 08:42, Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:
On 1 Mar 2014, at 07:50, zz d <zzd7zzd@gmail.com> wrote:
I can bind as a user by configure in virtual server authorize { update { control:Auth-Type := ldap } } It works well and can authenticate a user with LDAP . The "radiusd -X" output like (2) ldap : Performing search in 'ou=a,dc=b,dc=domain' with filter
'(sAMAccountName=abc)'
(2) ldap : Waiting for search result... (2) ldap : User object found at DN "CN=s,OU=s,OU=s,OU=a,DC=b,DC=domain" (2) ldap : Waiting for bind result... (2) ldap : Bind successful (2) ldap : Bind as user "CN=a,OU=ab,OU=a,OU=qiyi,DC=b,DC=domain" was successful What I want to do is update reply:Reply-Message with the user information, such as reply:Reply-Message := "CN=a,OU=ab,OU=a,OU=qiyi,DC=b,DC=domain" I've tried to update reply in "mods-available/ldap", but it not work.
You need to list the LDAP module in Post-Auth or Accounting...
Oops. Sorry, I misread your message because your config is so broken.
RHS in update block is an attribute name, NOT a DN, there are clear and explicit instructions about how to use the update block RIGHT ABOVE THE UPDATE BLOCK.
I advise you READ THEM.
https://github.com/FreeRADIUS/freeradius-server/blob/master/raddb/mods-avail...
Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 2 Mar 2014, at 12:44, zz d <zzd7zzd@gmail.com> wrote:
Thanks Arran.
I provided the config like that is because I want to show the key part of it.
Actually, I've read "mods-available/ldap" servral times before I post the mail. As shown in Figure below: Request Client ---> FreeRADIUS server <--> LDAP <--- Reply I've tried to configure in "mods-available/ldap" as "<radius attr> <op> <ldap attr>" like 1. reply:Reply-Message = 'mail' 2. Reply-Message = 'mail' 3. update { reply:Reply-Message = 'mail' } But the Reply in Figure does not contail attr Reply-Message. Is my "<ldap attr>" invalid? I've also tried "Mail / Name / name".
Thanks for your answer again.
Please post the full debug output. Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
My virtual server's config: https://www.evernote.com/shard/s16/sh/8714305e-6c78-4897-8381-439ef674aa22/4... The "mods-available/ldap": https://www.evernote.com/shard/s16/sh/45960e91-ded8-4a40-80cc-56596cb5c0fa/3... The "radiusd -X" output : https://www.evernote.com/shard/s16/sh/3d983c23-f458-41be-a506-47d29b173dbf/9... Arran, Thanks you so much. Perhaps I should spend more time on FR 3, write a module is also a chance. 2014-03-02 23:19 GMT+08:00 Arran Cudbard-Bell <a.cudbardb@freeradius.org>:
On 2 Mar 2014, at 12:44, zz d <zzd7zzd@gmail.com> wrote:
Thanks Arran.
I provided the config like that is because I want to show the key part of it.
Actually, I've read "mods-available/ldap" servral times before I post the mail. As shown in Figure below: Request Client ---> FreeRADIUS server <--> LDAP <--- Reply I've tried to configure in "mods-available/ldap" as "<radius attr> <op> <ldap attr>" like 1. reply:Reply-Message = 'mail' 2. Reply-Message = 'mail' 3. update { reply:Reply-Message = 'mail' } But the Reply in Figure does not contail attr Reply-Message. Is my "<ldap attr>" invalid? I've also tried "Mail / Name / name".
Thanks for your answer again.
Please post the full debug output.
Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hello, Arran. It seems that I've solved the problem. In "mods-available/ldap" update section, I changed reply:Reply-Message := 'mail' to reply:Reply-Message := 'distinguishedName' And then the reply contains "Reply-Message := 'value_of_distinguishedName'". It's strange. I am sure ldap returns attribute "mail". 2014-03-03 0:42 GMT+08:00 zz d <zzd7zzd@gmail.com>:
My virtual server's config: https://www.evernote.com/shard/s16/sh/8714305e-6c78-4897-8381-439ef674aa22/4... The "mods-available/ldap": https://www.evernote.com/shard/s16/sh/45960e91-ded8-4a40-80cc-56596cb5c0fa/3... The "radiusd -X" output : https://www.evernote.com/shard/s16/sh/3d983c23-f458-41be-a506-47d29b173dbf/9...
Arran, Thanks you so much. Perhaps I should spend more time on FR 3, write a module is also a chance.
2014-03-02 23:19 GMT+08:00 Arran Cudbard-Bell <a.cudbardb@freeradius.org>:
On 2 Mar 2014, at 12:44, zz d <zzd7zzd@gmail.com> wrote:
Thanks Arran.
I provided the config like that is because I want to show the key part of it.
Actually, I've read "mods-available/ldap" servral times before I post the mail. As shown in Figure below: Request Client ---> FreeRADIUS server <--> LDAP <--- Reply I've tried to configure in "mods-available/ldap" as "<radius attr> <op> <ldap attr>" like 1. reply:Reply-Message = 'mail' 2. Reply-Message = 'mail' 3. update { reply:Reply-Message = 'mail' } But the Reply in Figure does not contail attr Reply-Message. Is my "<ldap attr>" invalid? I've also tried "Mail / Name / name".
Thanks for your answer again.
Please post the full debug output.
Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 3 Mar 2014, at 03:11, zz d <zzd7zzd@gmail.com> wrote:
Hello, Arran. It seems that I've solved the problem. In "mods-available/ldap" update section, I changed reply:Reply-Message := 'mail' to reply:Reply-Message := 'distinguishedName' And then the reply contains "Reply-Message := 'value_of_distinguishedName'".
It's strange. I am sure ldap returns attribute "mail".
Use ldapsearch to verify, all the filters and DN's you need to test functionality should be output by rlm_ldap. It's very unlikely that the mapping would work for one attribute and not another. Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
participants (2)
-
Arran Cudbard-Bell -
zz d