Multi-valued LDAP attribute
Hi All, In a continuation to my previous issue about how to reference an LDAP attribute in post-auth, I am now wondering how to iterate through a multi-valued attribute in a perl script I call from post-auth. In the debug you can see all three values are returned: ... [ldap] looking for reply items in directory... [ldap] personType -> Person-Type = "employee" [ldap] personType -> Person-Type = "fulltime" [ldap] personType -> Person-Type = "it" ... The perl module currently has the following code because I can't seem to be able to get any result other than the first, ie "employee", and I really need the other two (possibly more) to do a proper VLAN assignment: while (($att,$val) = each(%RAD_REPLY)){ if ($att =~ 'Person-Type'){ $count++; if ($count == 1){ $one = $val; } else { $two = $val; } } } $RAD_REPLY{'Reply-Message'} = "Total: $count, first: $one, second: $two."; The results are: ... Reply-Message = "Total: 1, first: employee, second: ." ... I'm no perl expert, but shouldn't I be able to reference all three values with $RAD_REPLY{'Person-Type'}? If not, where are the other values being stored? I read from the archives that this can be done with 3.X and foreach using unlang, but I'm stuck with 2.1.10 at the moment. Or, do multi-valued attributes need to be defined another way? Thanks, A.
Adam Track wrote:
In a continuation to my previous issue about how to reference an LDAP attribute in post-auth, I am now wondering how to iterate through a multi-valued attribute in a perl script I call from post-auth. In the debug you can see all three values are returned:
Multi-value attributes are an array in Perl.
I'm no perl expert, but shouldn't I be able to reference all three values with $RAD_REPLY{'Person-Type'}?
No. That entry is an array. You need @{$RAD_REPLY{'Person-Type'}}, and then de-reference each entry from there. See the Perl documentation for more information. Alan DeKok.
In a continuation to my previous issue about how to reference an LDAP
attribute in post-auth, I am now wondering how to iterate through a multi-valued attribute in a perl script I call from post-auth. In the debug you can see all three values are returned:
Multi-value attributes are an array in Perl.
I'm no perl expert, but shouldn't I be able to reference all three values with $RAD_REPLY{'Person-Type'}?
No. That entry is an array. You need @{$RAD_REPLY{'Person-Type'}}, and then de-reference each entry from there.
I'm still having no luck trying to get all of the values off this multi-valued attribute.. I believe I've got the perl syntax correct but when I try to dereference @{$RAD_REPLY{'Person-Type'}} to check through all values, I get: rlm_perl: perl_embed:: module = /etc/freeradius/groupcheck.pl , func = post_auth exit status= Can't use string ("employee") as an ARRAY ref while "strict refs" in use at /etc/freeradius/groupcheck.pl line 112. It appears as though $RAD_REPLY{'Person-Type'} is a string not an array.. if I ask for value, I get "employee".. But again, all three values are returned: ... [ldap] looking for reply items in directory... [ldap] personType -> Person-Type = "employee" [ldap] personType -> Person-Type = "fulltime" [ldap] personType -> Person-Type = "it" WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user atrack authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ... I did notice the following in the post-auth debug: ... rlm_perl: Added pair User-Name = atrack rlm_perl: Added pair MS-MPPE-Recv-Key = 0xc8bf3146d6b3966f0838e304da9bf9d2 rlm_perl: Added pair Person-Type = employee rlm_perl: Added pair EAP-Message = 0x03090004 rlm_perl: Added pair MS-MPPE-Send-Key = 0x46948d82b0b42f60dd31e93a0d643790 ... So, for Person-Type, only the one value, employee, is passed to the perl module? Shouldn't there be another two lines of this for the other two values? I (finally) upgraded to 2.1.12, with same results. How can I get the other values? Or, is there a better way to do this? Thanks, A.
Adam Track wrote:
I'm still having no luck trying to get all of the values off this multi-valued attribute.. I believe I've got the perl syntax correct but when I try to dereference @{$RAD_REPLY{'Person-Type'}} to check through all values, I get:
rlm_perl: perl_embed:: module = /etc/freeradius/groupcheck.pl , func = post_auth exit status= Can't use string ("employee") as an ARRAY ref while "strict refs" in use at /etc/freeradius/groupcheck.pl line 112.
This is really a Perl question.
But again, all three values are returned:
... [ldap] looking for reply items in directory... [ldap] personType -> Person-Type = "employee" [ldap] personType -> Person-Type = "fulltime"
Read raddb/ldap.attrmap. This is documented.
I did notice the following in the post-auth debug: ... So, for Person-Type, only the one value, employee, is passed to the perl module? Shouldn't there be another two lines of this for the other two values?
No. The default operator for the LDAP attribute mapping is '='. If you want '+=', edit ldap.attrmap. This has been in ldap.attrmap, *and* documented there since 2004. If you're editing the file to add "personType", the PLEASE READ THE FILE. Alan DeKok.
No. The default operator for the LDAP attribute mapping is '='. If you want '+=', edit ldap.attrmap.
This has been in ldap.attrmap, *and* documented there since 2004. If you're editing the file to add "personType", the PLEASE READ THE FILE.
Thank you very much for that. Again, I wouldn't have figured that out on my own. I only email the list as a last resort. I'd also like to add, although I'm probably going to have my head chopped off, that I did read the file.. many times in the past, several times today in fact, but unfortunately my brain did not interpret the operator description to mean that one need add += for multi-valued attributes (much like all my questions before did not seem obvious to me, though I suppose they are to others); my brain was sidetracked thinking I needed another attribute type in the dictionary file. Anyway, I hope at least this email will prevent others from asking the same silly question. A.
Adam Track wrote:
I'd also like to add, although I'm probably going to have my head chopped off, that I did read the file.. many times in the past, several times today in fact, but unfortunately my brain did not interpret the operator description to mean that one need add += for multi-valued attributes (much like all my questions before did not seem obvious to me, though I suppose they are to others); my brain was sidetracked thinking I needed another attribute type in the dictionary file.
That's why the comments said to read the documentation for the "users" file. It has *complete* documentation on all of the operators. It's just too hard to copy all of the operator documentation into every file / module which uses it. They're the same everywhere, so the documentation often says "go read the FULL documentation". Alan DeKok.
participants (2)
-
Adam Track -
Alan DeKok