Reply-Items in Ldap-Group
I wish to assign various Reply-Items to a group defined in LDAP, and then configuring FreeRADIUS to fetch those Reply-Items whenever a user belonging to that group authenticates. Is that possible? Thank you!
Yes. DEFAULT Ldap-Group == whatever reply, reply Ivan Kalik Kalik Informatika ISP Dana 1/3/2008, "Giovanni Lovato" <giovanni.lovato@aldu.net> piše:
I wish to assign various Reply-Items to a group defined in LDAP, and then configuring FreeRADIUS to fetch those Reply-Items whenever a user belonging to that group authenticates. Is that possible?
Thank you!
Ivan Kalik wrote:
Yes.
DEFAULT Ldap-Group == whatever reply, reply
Thanks, but I meant if I could store that reply-items directly in LDAP attributes. It works for users, for example: dn: uid=testuser,dc=example,dc=org uid: testuser ... objectClass: radiusProfile radiusFramedIPAddress: 192.0.2.1 When 'testuser' authenticates, FreeRADIUS correctly replies with Framed-IP-Address to the NAS. I wish to store some reply-items on a group: dn: cn=testgroup,dc=example,dc=org cn: testgroup member: testuser1 member: testuser2 member: testuser3 ... radiusReplyItem: Mikrotik-Rate-Limit := "128k" so that all members of 'testgroup' gets that reply-item!
UNCLASSIFIED
-----Original Message----- From: freeradius-users-bounces+frank.ranner=defence.gov.au@lists.fre eradius.org [mailto:freeradius-users-> bounces+frank.ranner=defence.gov.au@lists.freeradius.org] On Behalf Of Giovanni Lovato Sent: Saturday, 1 March 2008 11:23 To: FreeRadius users mailing list Subject: Reply-Items in Ldap-Group
I wish to assign various Reply-Items to a group defined in LDAP, and then configuring FreeRADIUS to fetch those Reply-Items whenever a user
belonging to that group authenticates. Is that possible?
Thank you!
You can use an indirect method: In users you can specify: DEFAULT Ldap-Group == "netops", User-Profile:='cn=netops,ou=profiles,dc=example' In ldap: dn: cn=netops,ou=Profiles,dc=example objectClass: radiusprofile objectClass: applicationProcess objectClass: top cn: netops description: Profile for all devices for netops users radiusReplyItem: Passport-Customer-Identifier = 0 radiusReplyItem: Passport-Command-Scope = network radiusReplyItem: Passport-Allowed-Access = telnet radiusReplyItem: Passport-Allowed-Access += ftp radiusReplyItem: Passport-Allowed-Access += fmip radiusReplyItem: Passport-Allowed-Access += local radiusReplyItem: Passport-Login-Directory = / radiusReplyItem: Passport-Timeout-Protocol = enabled radiusReplyItem: Passport-AllowedOut-Access = telnet radiusReplyItem: Reply-Message := "Hello Network Administrator." radiusReplyItem: Passport-Command-Impact = configuration radiusReplyItem: Access-Level = RW radiusServiceType: Administrative-User Of course, the group record itself can be the profile. In my case, groups are defined using the radiusgroupname attibute in the users record. If you are using groupofnames then you could do : DEFAULT Ldap-Group == "netops", User-Profile:='cn=netops,ou=groups,dc=example' Regards, Frank Ranner
Ranner, Frank MR wrote:
-----Original Message----- From: freeradius-users-bounces+frank.ranner=defence.gov.au@lists.fre eradius.org [mailto:freeradius-users-> bounces+frank.ranner=defence.gov.au@lists.freeradius.org] On Behalf Of Giovanni Lovato Sent: Saturday, 1 March 2008 11:23 To: FreeRadius users mailing list Subject: Reply-Items in Ldap-Group
I wish to assign various Reply-Items to a group defined in LDAP, and then configuring FreeRADIUS to fetch those Reply-Items whenever a user
belonging to that group authenticates. Is that possible?
Thank you!
You can use an indirect method:
In users you can specify:
DEFAULT Ldap-Group == "netops", User-Profile:='cn=netops,ou=profiles,dc=example'
Ok, thank you very much. Can I place that `User-Profile' attribute directly in the LDAP user dn? I tried but it didn't work. I wish not to modify `users' file, but only LDAP if possible!
Giovanni Lovato wrote:
Ranner, Frank MR wrote:
-----Original Message----- From: freeradius-users-bounces+frank.ranner=defence.gov.au@lists.fre eradius.org [mailto:freeradius-users-> bounces+frank.ranner=defence.gov.au@lists.freeradius.org] On Behalf Of Giovanni Lovato Sent: Saturday, 1 March 2008 11:23 To: FreeRadius users mailing list Subject: Reply-Items in Ldap-Group
I wish to assign various Reply-Items to a group defined in LDAP, and then configuring FreeRADIUS to fetch those Reply-Items whenever a user belonging to that group authenticates. Is that possible?
Thank you!
You can use an indirect method:
In users you can specify:
DEFAULT Ldap-Group == "netops", User-Profile:='cn=netops,ou=profiles,dc=example'
Ok, thank you very much. Can I place that `User-Profile' attribute directly in the LDAP user dn? I tried but it didn't work. I wish not to modify `users' file, but only LDAP if possible!
I found a very simple way to do this: 1. in radiusd.conf uncomment: profile_attribute = "radiusProfileDn" 2. in LDAP entries, add `radiusProfileDn' attribute and fill it with the DN of the entry where RADIUS Reply-Items are defined. Bye, Giovanni Lovato
participants (3)
-
Giovanni Lovato -
Ivan Kalik -
Ranner, Frank MR