Luo, Frank Y.F. Mr. wrote:

I have a senario, no ldap schema extension is wanted ( no ldap group or profile is wanted); we do use ldap authentication though; and it works fine. after authentication, we need to check one ldap attribute like "vpn" and and return "class: ou={ldap vpn value}" back to the radius client (the cisco concentrator).

So in the sites_avaiable/default, I have this

post-auth { update reply { class = "ou=%Profile" }

Well, that's wrong. See "man unlang" for documentation. And the Profile attribute doesn't exist.

and in ldap.attrmap, i have

replyItem Profile VPN

There must a syntax error on how to refer a ldap attribute value here. since what I got is this

# Executing section post-auth from file /opt/freeradius/etc/raddb/sites-enabled/default +- entering group post-auth {...} WARNING: Unknown variable '%P': See 'doc/variables.txt'

And WHAT is unclear about that message? Did you bother to READ the file "doc/variables.txt"?

Any clue how to implement this?

The server is telling you to read documentation. Go read it. The answers are there. See also "man unlang" You've managed to make a number of different mistakes in the config. And then compounded that by NOT reading the documentation that tells you how to fix those mistakes. Alan DeKok.