Hi, Is there some way to configure free radius to use openldap groups? Like.. My user1 is group ceo and can connect to the wifi lan… but user2 is at the group "nowifi" and then not allowed to connect at wifi lan. And is possible to identify the source of the connection? Some regex exp. Like: If username = user1 and source ip is = classB Allow connection to switch or wlc Else Reject ? Thank You Atenciosamente, Jean Carlos Coelho Analista de Soluções Teltec Solutions Fone: 48 3031.3450 | DDR: 467 | Cel: 48 9179.6013 [http://suporte.teltecnetworks.com.br/images/Assinaturas/figura.jpg]<http://www.teltecsolutions.com.br/site2009/downloads/sign.html>
Jean Carlos Coelho wrote:
Is there some way to configure free radius to use openldap groups?
Yes. Use the LDAP-Group attribute to check group membership.
Like.. My user1 is group ceo and can connect to the wifi lan… but user2 is at the group "nowifi" and then not allowed to connect at wifi lan. And is possible to identify the source of the connection? Some regex exp. Like:
if (Packet-Src-IP-Address == wifi.ip) { if (LDAP-Group == "wifi") { # ... do things ... } else { reject } } Alan DeKok.
Ok This conf is at "post-auth"? Where can I find some how to's to configure this actions? 21/10/13 11:12, "Alan DeKok" <aland@deployingradius.com> wrote:
Jean Carlos Coelho wrote:
Is there some way to configure free radius to use openldap groups?
Yes. Use the LDAP-Group attribute to check group membership.
Ok, after send this message I make some local tests (debug) and is Ok, I need to integrate ldap to pam and then use only the primary groups, that's it?
Like.. My user1 is group ceo and can connect to the wifi lanŠ but user2 is at the group "nowifi" and then not allowed to connect at wifi lan. And is possible to identify the source of the connection? Some regex exp. Like:
if (Packet-Src-IP-Address == wifi.ip) { if (LDAP-Group == "wifi") { # ... do things ... } else { reject } }
This conf is at "post-auth"? Where can I find some how to's to configure this actions (regular expressions)?
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 21 Oct 2013, at 15:07, Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:
This conf is at "post-auth"? Where can I find some how to's to configure this actions (regular expressions)?
Um sure, or in authorize.
man unlang?
Wait you want to use a regex to match groups? That's not possible. http://stackoverflow.com/questions/6293231/ldap-search-using-regular-express... Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
On 21/10/13 12:07, "Arran Cudbard-Bell" <a.cudbardb@freeradius.org> wrote:
On 21 Oct 2013, at 15:07, Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:
This conf is at "post-auth"? Where can I find some how to's to configure this actions (regular expressions)?
Um sure, or in authorize.
man unlang?
Wait you want to use a regex to match groups? That's not possible.
No I am trying to use (configure) something like thisŠ Wifi lan = 10.10.10.0/24 (company vlan22 [mngmt = vlan1]) Cable lan = 192.168.0.0/24 (company vlan23 [mngmt = vlan1]) Net academy (all school) = 172.16.5.10 (vlan5) If access TO mngmt switch (or WLC) is from vlan22 or vlan23 and primary ldap group for user john equals "ti" Then set admin vlan1 mngmt And access ok (wlc or switch) Else Reject
http://stackoverflow.com/questions/6293231/ldap-search-using-regular-expre ssion
Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Jean Carlos Coelho wrote:
No I am trying to use (configure) something like this
I gave you an example of how to do it. You need to read "man unlang", and the debug output. Put the two together.
Wifi lan = 10.10.10.0/24 (company vlan22 [mngmt = vlan1]) Cable lan = 192.168.0.0/24 (company vlan23 [mngmt = vlan1]) Net academy (all school) = 172.16.5.10 (vlan5)
If access TO mngmt switch (or WLC) is from vlan22 or vlan23 and primary ldap group for user john equals "ti" Then set admin vlan1 mngmt And access ok (wlc or switch) Else Reject
This can be done almost exactly as you've written it above. You need to read the debug output to get the attribute names and values. Then, write it in "unlang". It really is that simple. Alan DeKok.
participants (3)
-
Alan DeKok -
Arran Cudbard-Bell -
Jean Carlos Coelho