On 11 Dec 2013, at 10:44, Hachmer, Tobias <Tobias.Hachmer@stadt-frankfurt.de> wrote:

...

Assuming the FR3 RPM behaves the same as the FR2 one, easiest way is to build with Mock rather than rpmbuild. There are no RPM packages at all but in fedora. To use mock I need a src rpm. I can build this by 'rpmbuild -bs freeradius.spec' but I think to package the debug symbols as well I need to modify the spec file. But please correct me if I'm wrong.

You can use rpmbuild to construct an srpm suitable for mock to use - off the top of my head, I think it’s rpmbuild -ts <specfile> Have a look at the manpage for rpmbuild, it should tell you how to turn a tarball + specfile into an srpm. Regards, Adam Bishop gpg: 0x6609D460 Janet, the UK's research and education network. Janet(UK) is a trading name of Jisc Collections and Janet Limited, a not-for-profit company which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Oxford, Didcot, Oxfordshire. OX11 0SG. VAT No. 614944238

On 11/12/13 10:44, Hachmer, Tobias wrote:

There are no RPM packages at all but in fedora. To use mock I need a src rpm. I can build this by 'rpmbuild -bs freeradius.spec' but I think to package the debug symbols as well I need to modify the spec file. But please correct me if I'm wrong.

You're wrong ;o) Generation of -debuginfo packages is part of the build setup, not the .spec file. Mock does it; you can make rpmbuild do it, but I don't know how.

Hi, Is there some way to configure ldap at radius to read only object classes and not groups? To allow or reject the access to some destination? Eg. groupname_attribute = cn groupmembership_filter = "(&(objectClass=posixGroup)(memberUid=%{User-Name})(objectclass=brEduPerson))” Is there some way to configure ldap at radius to read only object classes and not groups? To allow My LDAP server does not have groups, so I can’t use the above… how can I get some object classes? Instead of groups? Like (search logs in debug down): uid=69327181034 brEduAffiliation brEntranceDate: 20091008 brEduAffiliation: 1 brEduAffiliationType: employee objectClass: brEduPerson uid=02494605059 brEduAffiliation=1 brEntranceDate: 20120110 brEduAffiliation: 1 brEduAffiliationType: student objectClass: brEduPerson The search returns this: Wed Dec 11 14:18:44 2013 : Info: +- entering group post-auth {...} Wed Dec 11 14:18:44 2013 : Info: ++? if (LDAP-Group == "student") Wed Dec 11 14:18:44 2013 : Debug: [ldap] Entering ldap_groupcmp() Wed Dec 11 14:18:44 2013 : Info: expand: ou=people,dc=DOMAIN,dc=EDU -> ou=people,dc=DOMAIN,dc=EDU Wed Dec 11 14:18:44 2013 : Info: expand: (&(objectClass=posixGroup)(memberUid=%{User-Name})(objectclass=brEduPerson)) -> (&(objectClass=posixGroup)(memberUid=74879995053)(objectclass=brEduPerson)) Wed Dec 11 14:18:44 2013 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Wed Dec 11 14:18:44 2013 : Debug: [ldap] ldap_get_conn: Got Id: 0 Wed Dec 11 14:18:44 2013 : Debug: [ldap] performing search in ou=people,dc=DOMAIN,dc=EDU, with filter (&(cn=student)(&(objectClass=posixGroup)(memberUid=74879995053)(objectclass=brEduPerson))) Wed Dec 11 14:18:44 2013 : Debug: [ldap] object not found Wed Dec 11 14:18:44 2013 : Debug: [ldap] ldap_release_conn: Release Id: 0 Wed Dec 11 14:18:44 2013 : Debug: rlm_ldap::ldap_groupcmp: Group student not found or user is not a member. Wed Dec 11 14:18:44 2013 : Info: ? Evaluating (LDAP-Group == "student") -> FALSE Thank You

The question is, I can configure a ³groupsearch² for 2 different objectclasses when all the database have no groups? (everybody is in the same group) Like this.. Group (ALL users at the same group) - User1 (objectClass - Student) - User2 (objectClass - Teacher) Thank's On 11/12/13 15:20, "John Dennis" <jdennis@redhat.com> wrote:

On 12/11/2013 11:20 AM, Jean Carlos Coelho wrote:

...

Hi,

Is there some way to configure ldap at radius to read only object classes and not groups? To allow or reject the access to some destination?

This question makes no sense because everything in LDAP belongs to an object class. You can't have LDAP data that isn't in an object class.

You can change the LDAP searches to return whatever you want. Figure out what you want, modify the search, and act upon the result using unlang. There examples on how to do this in the archives of this list.

Hint: use the ldapsearch command line tool to figure out how to construct your search, then paste that search into your radius config.

-- John - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Thanks, but here on CentOS 6.5 rpmbuild -ba produces only a "debug" package (not "debuginfo") if the specfile contains "%debug_package".

Tobias, This link was built with the official spec using rpmbuild -ba: https://www.dropbox.com/sh/sbqyy7gvzrd3egt/01XK3TUzKg/FreeRADIUS/freeradius-... It contains a debuginfo package, as well as the src.rpm if you don't want to use the binaries. Regards Stefan -- This e-mail and any attachments may contain confidential, copyright and or privileged material, and are for the use of the intended addressee only. If you are not the intended addressee or an authorised recipient of the addressee please notify us of receipt by returning the e-mail and do not use, copy, retain, distribute or disclose the information in or attached to the e-mail. Any opinions expressed within this e-mail are those of the individual and not necessarily of Diamond Light Source Ltd. Diamond Light Source Ltd. cannot guarantee that this e-mail or any attachments are free from viruses and we cannot accept liability for any damage which you may sustain as a result of software viruses which may be transmitted in or with the message. Diamond Light Source Limited (company no. 4375679). Registered in England and Wales with its registered office at Diamond House, Harwell Science and Innovation Campus, Didcot, Oxfordshire, OX11 0DE, United Kingdom