ldap: multiple radius profiles
Dear listmembers, I have following setup: - Centos 6.4 - freeradius version: radiusd: FreeRADIUS Version 2.1.12, for host x86_64-redhat-linux-gnu, built on Oct 3 2012 at 01:22:51 - authorization & authentication in ldap (openldap) What I am trying to achieve is: - manage radius profiles completely in ldap with replyItems - return reply Items of multiple profiles to a user if he belongs to multiple profiles Example RADIUS Profiles: dn: uid=aosReadWrite,ou=profiles,ou=radius,dc=example,dc=com cn: AOS Read-Write objectClass: radiusObjectProfile objectClass: radiusProfile uid: aosReadWrite radiusReplyItem: Alcatel-Access-Priv += "Alcatel-Read-Priv" radiusReplyItem: Alcatel-Access-Priv += "Alcatel-Write-Priv" radiusReplyItem: Alcatel-Access-Priv += "Alcatel-Admin-Priv" radiusReplyItem: Alcatel-Acce-Priv-F-W1 = 0xffffffff radiusReplyItem: Alcatel-Acce-Priv-F-W2 = 0xffffffff dn: uid=sosReadWrite,ou=profiles,ou=radius, dc=example,dc=com cn: screenOS Read-Write objectClass: radiusObjectProfile objectClass: radiusProfile uid: sosReadWrite radiusReplyItem: NS-Admin-Privilege = "Root-Admin" Example RADIUS User: dn: uid=hachmer,ou=users,ou=radius,dc=example,dc=com cn: Tobias Hachmer givenName: Tobias mail: tobias.hachmer@stadt-frankfurt.de radiusServiceType: Administrative-User sn: Hachmer uid: hachmer objectClass: top objectClass: inetOrgPerson objectClass: radiusProfile userPassword:: ... radiusGroupName: aosReadWrite radiusGroupName: sosReadWrite I don't know how to configure FreeRADIUS to read the "radiusGroupName" attribute and attach the configured return Items to the return list. Using unlang I am able to do this: if(Ldap-Group == "cn=aosReadWrite,ou=groups,ou=radius,dc=example,dc=com") { update reply { Alcatel-Access-Priv = Alcatel-Read-Priv Alcatel-Access-Priv += Alcatel-Write-Priv Alcatel-Access-Priv += Alcatel-Admin-Priv Alcatel-Acce-Priv-F-W1 := 0xffffffff Alcatel-Acce-Priv-F-W2 := 0xffffffff Alcatel-Asa-Access := All } } if(Ldap-Group == "cn=sosReadWrite,ou=groups,ou=radius, dc=example,dc=com ") { update reply { NS-Admin-Privilege := Root-Admin } } This is working fine but has the disadvantage that I have to configure the return items static into freeradius configuration files. I want to manage these profiles also in ldap. Is this possible? Kind regards, Tobias Hachmer
I don’t know how to configure FreeRADIUS to read the “radiusGroupName” attribute and attach the configured return Items to the return list.
*configured reply items to the reply list.
Using unlang I am able to do this: if(Ldap-Group == "cn=aosReadWrite,ou=groups,ou=radius,dc=example,dc=com") { update reply { Alcatel-Access-Priv = Alcatel-Read-Priv Alcatel-Access-Priv += Alcatel-Write-Priv Alcatel-Access-Priv += Alcatel-Admin-Priv Alcatel-Acce-Priv-F-W1 := 0xffffffff Alcatel-Acce-Priv-F-W2 := 0xffffffff Alcatel-Asa-Access := All } } if(Ldap-Group == "cn=sosReadWrite,ou=groups,ou=radius, dc=example,dc=com ") { update reply { NS-Admin-Privilege := Root-Admin } }
This is working fine but has the disadvantage that I have to configure the return items static into freeradius configuration files.
Yes.
I want to manage these profiles also in ldap. Is this possible?
Well yes, that's the point of RADIUS profile in LDAP. You need to set the "profile_attribute" configuration item to "radiusGroupName". IIRC you also need to use full DNs for the radiusGroupName values. Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
I don't know how to configure FreeRADIUS to read the "radiusGroupName" attribute and attach the configured return Items to the return list. *configured reply items to the reply list.
Of course, sorry for inaccuracy.
I want to manage these profiles also in ldap. Is this possible? Well yes, that's the point of RADIUS profile in LDAP. You need to set the "profile_attribute" configuration item to "radiusGroupName". IIRC you also need to use full DNs for the radiusGroupName values.
That was the missing hint. Thank you Arran! It is working as expected. Kind regards, Tobias Hachmer
participants (2)
-
Arran Cudbard-Bell -
Hachmer, Tobias