Group membership by SSID
Hello to all again, FreeRADIUS Version 2.2.8, for host x86_64-pc-linux-gnu, built on Apr 5 2016 at 13:40:43 I've got two SSID (Name_Lan and Name_Perso). Freeradius authentication using Active Directory (working fine, with and without require-membership-of) I wish to have a variable in modules/mschap linked to SSID. --require-membership-of=DOMAIN/Group1 for Name_Lan --require-membership-of=DOMAIN/Group2 for Name_Perso I don't find how to replace Group1 and Group2 with a variable (which variable ?). As I understand the unlang doc I cannot create new variables. I've also try to duplicate mschap module in mschap_perso and mschap_lan, then modify sites-available/default (and inner-tunnel) to add a test in authenticate section with : rewrite.called-station-id if (Called-Station-Id == "Name_Lan") { mschap_lan } but the is a syntax conf error when starting freeradius. TL;DR : how to test user group in AD based on SSID ? Thks a lot for any help/hint
On Tue, Feb 28, 2017 at 12:04:33PM +0100, Ethariel wrote:
FreeRADIUS Version 2.2.8, for host x86_64-pc-linux-gnu, built on Apr
Version 2 is obsolete; you should upgrade to version 3.
I wish to have a variable in modules/mschap linked to SSID.
--require-membership-of=DOMAIN/Group1 for Name_Lan --require-membership-of=DOMAIN/Group2 for Name_Perso
I don't find how to replace Group1 and Group2 with a variable
In the same way as all the other attributes on the ntlm_auth line (which I presume you're using for this): %{Attribute-Name}.
(which variable ?).
You could use one of the standard temporary attributes, such as Tmp-String-0
As I understand the unlang doc I cannot create new variables.
or add your own as explained in raddb/dictionary. They're RADIUS attributes, not "variables".
TL;DR : how to test user group in AD based on SSID ?
Best way at present is to use LDAP by configuring the rlm_ldap module. Matthew -- Matthew Newton, Ph.D. <mcn4@leicester.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
Hi,
Version 2 is obsolete; you should upgrade to version 3. I'll upgrade as soon as there is an official package on Ubuntu 16.04.
They're RADIUS attributes, not "variables". Thks for pointing me to Tmp-*
I'll try a little with that and will wait for the official package to upgrade and use rlm_ldap as advised. Thks for your help
On Mar 1, 2017, at 2:09 PM, Ethariel <ethariel@gmail.com> wrote:
Version 2 is obsolete; you should upgrade to version 3. I'll upgrade as soon as there is an official package on Ubuntu 16.04.
It's trivial to build your own Debian package: http://wiki.freeradius.org/building/Debian-and-Ubuntu Alan DeKok.
On Mar 2, 2017, at 6:33 AM, Ethariel <ethariel@gmail.com> wrote:
It's trivial to build your own Debian package:
I know but on this server (all prod servers) the politic is to use only official package
If your policy is to remain on an unsupported version, and one which was released many years ago... that's your choice. Upgrading to a supported and recent release is a much better idea. Alan DeKok.
If your policy is to remain on an unsupported version, and one which was released many years ago... that's your choice.
Upgrading to a supported and recent release is a much better idea.
I'll do it as soon as released. This politic is not my choice alone. Anyway it's out of subject.
Hello, just to let you know that with Tmp-String it works. Here is the conf : in sites-available/default and sites-available/inner-tunnel add in authorize section : rewrite.called_station_id if (Called-Station-Id == "Customer_Lan") { update request { Tmp-String-1 := "Wifi_Pro" } } if (Called-Station-Id == "Customer_Perso") { update request { Tmp-String-1 := "Wifi_Perso" } } Change rewrite.called_station_id : # Called-Station-Id := "%{Called-Station-Id}:%{8}" Called-Station-Id := "%{8}" (You can also keep the original and change the == test in the authorize section above) Then edit modules/mschap ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --domain=%{%{mschap:NT-Domain}:-customer.local} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00} --require-membership-of=CUSTOMER/%{request:Tmp-String-1}" Thks to Matthew for pointing to Tmp-String and I'll upgrade to 3.x asap. Rgds, 2017-03-03 18:21 GMT+01:00 Ethariel <ethariel@gmail.com>:
If your policy is to remain on an unsupported version, and one which was released many years ago... that's your choice.
Upgrading to a supported and recent release is a much better idea.
I'll do it as soon as released. This politic is not my choice alone. Anyway it's out of subject.
participants (3)
-
Alan DeKok -
Ethariel -
Matthew Newton